[laradji]

Summary

• Replace GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} with secrets.CHAIN_DISPATCH_TOKEN on chain-release.yml's Dispatch scrape-pack.yml step. The default token's anti-recursion gate allows the dispatch itself but suppresses the downstream workflow_run trigger on scrape-pack's completion, so chain-image.yml never fires. A user-owned PAT re-enables the chain.
• Rewrite the header comment block — the previous "the anti-recursion gate ... does NOT apply to workflow_dispatch" claim was wrong in the part that matters here (downstream workflow_run).
• Add a Validate secrets fail-fast step mirroring release.yml's RELEASE_PUBLISH_TOKEN check (matches the fix(ci): use PAT in release.yml so release.published fires downstream #148 precedent).

Closes #216. Same anti-recursion class as #148 (which fixed release.yml -> update-package-channels.yml).

Operator action required before this is effective

• Provision repo secret CHAIN_DISPATCH_TOKEN: fine-grained PAT, scope laradji/deadzone only, Actions: Read and write, no other permissions. Single-purpose secret, easier to audit/rotate than extending RELEASE_PUBLISH_TOKEN.
• Without the secret, chain-release will fail loudly on the next stable tag with a clear error pointing at repo settings → secrets and fix(ci): chain-release anti-recursion — GITHUB_TOKEN dispatch of scrape-pack suppresses chain-image workflow_run #216 (intentional — surfaces the missing PAT immediately instead of letting scrape-pack run to no avail).

Diagnostic recap (from #216)

scrape-pack run	event	triggering_actor	chain-image fired?
25505373769 (v0.7.2 tag, dispatched by chain-release.yml)	workflow_dispatch	github-actions[bot]	❌ no
25507444431 (manual probe by operator)	workflow_dispatch	laradji	✅ yes (run 25507936913)

Same event, same branch, same successful completion — only the actor differs. PAT swap makes triggering_actor a real user.

Test plan

• YAML lints — python3 -c "import yaml; yaml.safe_load(...)" passes.
• No regression: existing gates (workflow_run.conclusion == 'success', tag-push event, ^v[0-9]+\\.[0-9]+\\.[0-9]+$ stable-tag regex) unchanged.
• Pre-release tags still skip dispatch (and skip the PAT validation, so a missing PAT does NOT break pre-release tag pushes).
• End-to-end validation on v0.7.3 tag push (operator) — full chain release.yml → chain-release → scrape-pack → chain-image → docker-publish runs without manual gh workflow run calls. PR cannot be marked done until this validates.

Out of scope

Per #216: no changes to scrape-pack.yml, chain-image.yml, docker-publish.yml, or release.yml. The break is on the chain-release dispatch hop only.

Note on AC: the issue mentions adding a bullet to CLAUDE.md "Release operator secrets". That file is gitignored in this repo (see .gitignore); the operator can update their private copy outside the PR.