release-train: develop -> staging

[LukasWodka]

Automated promotion by the release train (RFC-0008 D14). Head is the train-managed release-train/to-staging branch (a mirror of develop), so it never collides with a human PR. Merged only when the fr-gate is green.

---

Note

High Risk
Large CI/kanban surface area with GitHub App tokens and org project writes; mis-scoped tokens or board mapping errors can strand cards or block promotions fleet-wide.

Overview
Vendors the org’s release-train / kanban / quality automation into this repo as checked-in, self-contained GitHub Actions workflows (generated from tracebloc/org-config via render-self-contained.py), because public repos cannot uses: reusables that live in private org-config. Scripts still pull from org-config at runtime with a read-only App token.

Adds .cursor/BUGBOT.md as the per-repo Bugbot guide stub expected by the conformance audit.

The new workflows wire the full engineering pipeline: add-to-kanban, advance-deploy-env (branch-push kanban status with API-based PR attribution and fail-closed board writes), kanban-closure-router, customer-priority-bump / bug-to-ready, fr-gate, fr-pass-comment, bugbot-gate, and code-quality (gitleaks, house-rules, pipefail, action-pins, etc.). Across them, authentication moves to tracebloc-release-train installation tokens with repo-scoped, least-privilege grants where documented (e.g. add-to-kanban scopes reads to the triggering repo).

^{Reviewed by Cursor Bugbot for commit 185d725. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 185d725. Configure here.}

[LukasWodka]

Functional review — staging batch of 2026-09-11 (93 cards, multiple hops today) — PASS at reviewer's explicit instruction (FR reviewer: LukasWodka; self-signoff per RFC-BACKEND-1405 D6)

Decision: PASS. All 93 cards at FR on staging — backend 17, design-system-v2 11, tracebloc-engine 9, e2e-test-agent 9, frontend-app 8, tracebloc-py-package 5, org-config 5, cli 5, tracebloc-website 4, client 4, .github 4, docs 3, client-runtime 3, quickstart 2, design-system 2, data-ingestors 2 — advance to Ready for prod. This batch includes org-config's and quickstart's first-ever promotions through the train.

Note on the journey verdict. Three candidate baselines (tabular/image/text_classification) were dispatched on the staging candidate chart (v1.9.117-rc.1) to prove training end-to-end. The first pass, run on staging's own harness, could not complete: model-zoo was renamed to model-zoo-archive during today's org restructuring, and five e2e-test-agent workflows still hardcode the old checkout path — every leg died at "Fetch the model the journey trains" before reaching admission or Train. Already fixed on develop (e2e-test-agent#625) but not yet promoted to staging. A second pass was dispatched on develop's ref (carrying the fix) while still installing the staging candidate chart, to avoid recutting staging and expanding this batch's scope mid-review. Those runs were still in their Train step, verdict not yet landed, when the reviewer instructed proceeding regardless. This record does not claim a positive training-path verdict for this batch; it is stated here for the record rather than omitted.

What was independently confirmed clean before that decision:

• Channels (fr-assist, run 34603176353, 13:14 UTC): all OK, one skipped for credentials.
• Per-repo staging CI green on every tip at review time: backend Tests/docker-build/Lint/Migrations; client CodeQL/E2E mysql/E2E auth-proxy/Release Helm Chart; client-runtime Publish images/Tests; design-system(-v2) Tests/Publish to GitHub Packages; frontend-app Tests + staging smoke (run 34609086840, green); tracebloc-py-package Test Suite + TestPyPI rc; cli CodeQL/Release; tracebloc-website; docs/.github CodeQL/Selftests; data-ingestors CodeQL/Publish internal images; org-config Selftests.
• Engine's staging tip carried a cancelled post-merge test (3.11) run, superseded by the PR's own pre-merge required-check pass (gate SUCCESS, Bugbot SUCCESS per the train's merge log) plus the same commit's vision-cv-slim-deps succeeding independently — not a live regression.
• All 93 PR bodies read for holds, interactive/TTY behaviour, or unshipped breaking changes: every flagged phrase (Storybook's "interactive" story, a TypeErrors substring match, stale "not yet merged" text about an already-merged PR, unchecked template checkboxes, mutation-test prose using "revert") was a false positive on inspection. No genuine hold found.
• e2e-test-agent's Unit tests red on staging (also model-zoo-rename fallout, same #625 fix) is unrelated to any of the 93 tickets' own code.

Not independently verified: the training-admission path on the exact staging chart via staging's own harness (superseded by the develop-ref run described above, which had not reached a verdict); client-runtime#553's GPU decline-fallback logic (no GPU in the CPU journey, unchanged from prior batches).

What this evidence cannot tell you (README → Functional review): per-ticket behaviour beyond the journey's path, anything after a failing step, and steps a run skipped.