ci(supply-chain): regenerate the approved-revision sets on a schedule and open the narrowing PR automatically #3552

🤖 Generated by the Agentic Engineer

Part of #3308 (third child; blocked by the generator child).

Evidence

Consumer uses: pins on the shared publish workflows move on every devantler-tech/actions bump, several times a month, by dependency automation. A narrowed matcher is stale the moment such a bump merges: the next artifact is signed by a revision the platform no longer accepts and the OCIRepository stops reconciling. Hand regeneration turns every dependency bump into a two-repository ordered rollout, which is the DevEx tax the hardening rule forbids.

Audience / impact

The narrowing in #3308 is only safe with an automated regeneration path; without it, the platform's own control breaks consumer delivery.

Expected

A scheduled platform workflow re-runs the generator, and when the committed set differs opens (or updates) a draft PR with the regenerated file and the matcher changes, on the ordinary review path. It must fail visibly when it cannot resolve a consumer rather than opening a PR that drops one. The narrowing switch on the matchers happens only after this workflow has run green at least once (feature-flag-first: generated file first, switch second).

Acceptance criteria

• Scheduled workflow committed, runs on a daily cadence and on demand, and opens exactly one open PR at a time for a moved set.
• A failed resolution surfaces as a red run, never as a PR omitting a consumer.
• One green scheduled run observed before the matcher switch lands.

Rough size: M.