v1 Unit 7: Migrate remaining callers

[mairas]

Part of the shared-workflows v1 plan (tracking issue: issue 49).

Goal: All 32 callers on halos-org/shared-workflows@v1.

Requirements: R2, R3, R4, R5, R6

Dependencies: Unit 5, Unit 6

Approach:

• Per-repo procedure:
  1. Pre-flight: list open drafts and open PRs. Publish or discard pending legacy drafts, or accept that the migration merge re-cuts them.
  2. Open the migration PR. Its run reports status.
  3. Change branch protection to require status only.
  4. Merge. The migration merge's own release is the R7 comparison point: .deb filename, changelog, and notes against the previous legacy release, and +N equal to previous N+1.
  5. Rebase or push to open PRs so they report status; re-running an old run does not add the check.
  6. Watch the first main run through apt-publish (or stage-release), then the first published draft's release.yml run.
• One PR per repo; independent, suitable for parallel execution.
• status.needs covers every job in pr.yml; verification greps for jobs missing from it.
• halos-pi-gen and flash-live-system keep their local release flows; the migration PR touches only shared-workflow refs and the status job.
• signalk-questdb-history-provider-archive is private and dormant: its release.yml moves to publish-npm.yml without a publish test.
• Includes check-image-updates (halos-core-containers, halos-marine-containers), translation-status (hatlabs/halpi2), version-bump-check (hatlabs/flash-live-system): ref change only, plus a status job where the repo lacks a caller-owned check.
• Branch protection per repo: require status only, set while the PR's run is visible. This also closes the gaps in the origin note (six repos not requiring version-bump-check, halos-halpi2-desktop requiring nothing).
• Repos with lintian disabled keep that choice explicitly (halos-core-containers, HALPI2-blinkenlights).
• Before the first hatlabs caller migrates, update the workspace AGENTS.md (halos-org/halos) section on per-org shared-workflows copies: hatlabs repos call halos-org/shared-workflows@v1 and pass apt-repository: hatlabs/apt.hatlabs.fi.

Test expectation: none -- mechanical caller edits; each PR's own run is the test.

Verification: Re-run the origin inventory script: zero references to @main, zero references to hatlabs/shared-workflows, every protected caller requires status.

[mairas]

From the review of PR 60: build-deb.yml finds packages in build/ and runs lintian by default. The container-app repos (halos-core-containers, halos-marine-containers) build into build/, so their generated packages have never been through lintian in CI (issue 32). Before migrating either repo, run its migration PR once with lintian enabled and decide from the result: fix or override the tags, or set lintian: false explicitly and file an issue.

[mairas]

Plan update from the PR 66 review: re-running an old PR run does not add status (a push or rebase does); the first main and release runs after each merge need watching because the migration PR never runs main.yml; the workspace AGENTS.md per-org copy rule is updated before the first hatlabs caller migrates.