[Dependency/Sync] Gate fleet fan-out on source validation and consumer canaries

[stranske]

Why

maint-68-sync-consumer-repos.yml:103-128 compiles one plan and immediately builds the full registered-repo matrix. Health 69 produces a typed, non-authorizing shadow handoff (.github/workflows/health-69-consumer-sync-shadow-evidence.yml:48-88), but no workflow uses representative consumer results as a promotion gate before the remaining fleet receives PRs. During the setup-python v7 delivery, source defects discovered in consumer review caused four 12-repo waves. This is a current sequencing defect: fleet PRs are used as the first compatibility environment.

Scope

• Add explicit preview, canary, and promote phases to Maint 68.
• Define a small representative canary set and the repo-shape capabilities each canary covers.
• Emit per-repo prospective diffs and affected-repo hashes before writes.
• Permit promotion only after the same plan ID has green, review-clear canary results.

Non-Goals

• Do not wait or sleep inside one workflow for cross-repo CI.
• Do not remove consumer compatibility testing or required checks.
• Do not promote on a canary from an older plan ID.
• Scaffold-only completion does NOT count: a phase input that still creates all fleet PRs in the canary phase fails this issue.

Tasks

• Add config/consumer_sync_canaries.json defining 2-3 representative repos and documented capability tags such as lock-heavy, custom-gate, and standard consumer.
• Add scripts/select_consumer_sync_phase.py to consume the compiled plan, requested phase, registered repos, and prior canary evidence and return an affected repo matrix.
• Extend .github/workflows/maint-68-sync-consumer-repos.yml with preview, canary, and promote inputs; an unfiltered normal run must start at canary.
• Reuse scripts/build_consumer_sync_shadow_handoff.py and Health 69 artifacts to record plan ID, per-repo desired hash, affected paths, and non-authorizing preview evidence.
• Emit a machine-readable canary result from Maint 71 containing plan ID, repo, PR, required-check state, and active-review-thread count.
• Add a promotion guard in Maint 68 that rejects missing, failed, stale, or mixed-plan canary evidence before constructing the remaining fleet matrix.
• Add tests/scripts/test_select_consumer_sync_phase.py and extend tests/workflows/test_sync_manifest_delivery.py for phase/matrix contracts.
• Update docs/ops/CONSUMER_REPO_MAINTENANCE.md and docs/WORKFLOW_GUIDE.md with the no-sleep, two-run promotion sequence and emergency override.

Acceptance Criteria

• python -m pytest tests/scripts/test_select_consumer_sync_phase.py tests/workflows/test_sync_manifest_delivery.py tests/scripts/test_consumer_sync_shadow_handoff.py -q passes.
• A default no-filter Maint 68 run at a new plan ID creates PRs only for configured canaries and writes prospective-diff evidence for every affected repo.
• promote rejects canary evidence with a different plan ID, a failed required check, or active non-outdated review debt.
• After all canaries are green and review-clear, promote targets only affected non-canary repos; unchanged/skipped repos never enter the matrix.
• Deliberate-break gate: alter one canary result fixture to an older plan ID; tests/scripts/test_select_consumer_sync_phase.py::test_promotion_rejects_stale_canary_evidence must fail the promotion decision. Restore the fixture before review.

Implementation Notes

• Relevant files: .github/workflows/maint-68-sync-consumer-repos.yml, .github/workflows/maint-71-merge-sync-prs.yml, .github/workflows/health-69-consumer-sync-shadow-evidence.yml, scripts/sync_manifest_compiler.py, scripts/build_consumer_sync_shadow_handoff.py, scripts/list_registered_consumer_repos.py, tests/workflows/test_sync_manifest_delivery.py, tests/scripts/test_consumer_sync_shadow_handoff.py, and docs/ops/CONSUMER_REPO_MAINTENANCE.md.
• Cross-repo CI completion must be observed in a later event/run; do not add polling sleeps.
• Emergency direct promotion should be explicit, audited, and limited to security or production-break fixes.