Ask policyengine.py to qualify each published data release

[MaxGhenis]

Summary

After the release build uploads the data and publishes the tag, it now sends a policyengine-uk-data-release repository dispatch to PolicyEngine/policyengine.py. That repository's certify-uk-release.yaml (PolicyEngine/policyengine.py#574) qualifies each new data release against the latest model before it can be promoted. Today it would only find a new release on its two-hourly schedule.

• Two steps at the end of the test job in .github/workflows/push.yaml:
  • actions/create-github-app-token@v3 with the org App (APP_ID, APP_PRIVATE_KEY, as versioning.yaml already uses), scoped to owner: PolicyEngine, repositories: policyengine.py.
  • gh api --method POST repos/PolicyEngine/policyengine.py/dispatches with event_type=policyengine-uk-data-release and client_payload[version] set to the version from .github/fetch_version.py, the same value publish-git-tag.sh tags.
• Neither step has a condition. The default success() means they run only when every earlier step succeeded, the upload and the tag included. There is no dry-run input on this workflow. A manual rebuild of an already-released version dispatches again, and policyengine.py deduplicates qualification attempts, so that is a no-op there.
• The version is read in the shell, never interpolated into run:.
• The App use was approved by Max (decision d1362).

No data change, no changelog fragment

This changes no data, no package code and no version. It deliberately has no changelog fragment: a fragment would trigger versioning.yaml, bump the version, and release data outside the d833 batch. The changelog check passes on the fragments already pending on main. This PR can land independently of that batch.

Tests

policyengine_uk_data/tests/test_release_dispatch.py (4 tests, run locally against this push.yaml; they need only PyYAML):

• the dispatch comes after "Upload data" and "Publish a git tag", with no condition and no continue-on-error;
• the token is scoped to policyengine.py and is the step's only environment;
• running the step's script with a fake gh sends exactly the event type and the version from pyproject.toml;
• with no readable version, it fails and sends nothing.

actionlint passes apart from the existing queue: max key, which actionlint does not yet know.

Requested by the UK hub for the UK Autumn Budget 2026 CI plan (workstream W4).

🤖 Generated with Claude Code

[MaxGhenis]

Hand-off to the UK hub (W4, release qualification). This PR is ready; it waits only for the d833 uk-data batch.

• Head: 1577a38d.
• Review: GPT-6.1 Sol approved in round 2 at 054d0265. Its one Low finding was that dropping --exit-code or adding || true to the dispatch passed every test. 1577a38d is a tests-only change that closes it:
  • the fake git now answers ls-remote the way git does (only --exit-code makes a missing ref exit 2);
  • the tests assert the exact ls-remote arguments;
  • a new test makes a rejected dispatch fail the step.
  • I re-ran both mutants: each now fails tests (2 and 1 failures). 7 tests pass.
• CI: every check passes (Lint, Test, changelog fragment, bundle release manifest contract). The PR is mergeable.
• Changelog: none, intentionally. The change is workflow-only, so it doesn't version the package.
• Dependency: the consumer is Qualify UK model and data candidates automatically before promotion policyengine.py#574 (certify-uk-release.yaml), which listens for policyengine-uk-data-release with client_payload.version. Until 16 households have a negative vehicle count on 1.58.0 (WAS missing-value code in the wealth imputation) #574 merges, a dispatch reaches a workflow that doesn't exist yet and does nothing. That is harmless, and nothing here needs 16 households have a negative vehicle count on 1.58.0 (WAS missing-value code in the wealth imputation) #574 first.
• Follow-ups owed: none.

[MaxGhenis]

UK hub (2026-10-12 16:55Z): the hub's GPT-6.1 Sol delta review of 1577a38d found no code defect. push.yaml is byte-identical to the approved 054d0265, the tests run the workflow's real run block, and nothing is weakened. It held back only because its sandbox could not run the two mutations, so the hub ran them: the original passes 7 tests; dropping --exit-code fails 2; adding || true to the dispatch fails 1. That matches the review's prediction exactly. This PR is batch-ready for the next uk-data batch (d833).