ci: centralize shared GitHub automation

[junwu168]

Problem

Release and Feishu workflow implementations are stored directly in OpenPI, which duplicates organization-owned automation and couples reusable mechanics to the product repository.

Value

Centralizing shared automation gives the organization one reviewable source of truth while leaving project-specific CI close to OpenPI's package layout and tests.

Approach

• Add public openpi-dev/automation reusable workflows for OpenPI release and Feishu PR notifications.
• Source both reusable workflows from openpi-dev/automation@main; the required contract coverage was merged through automation PR #1.
• Keep triggers, concurrency, least-privilege permissions, repository secrets, and release OIDC authority in OpenPI.
• Keep OpenPI CI unchanged and project-local.
• Add behavioral actions and contract tests in the automation repository for the migrated security and release boundaries.

Validation

• Automation repository: npm test — 16 passed, covering draft suppression, secret pairing, metadata sanitization/injection and Unicode bounds, Feishu HMAC and response validation, release event/ref/tag validation, tag/package-version integrity, artifact transfer, and publish OIDC/environment boundaries.
• Automation repository: GitHub Test actions for PR Test: verify GitHub Issues are enabled #1 — passed.
• OpenPI: YAML parse for every workflow — passed.
• OpenPI: targeted automation workflow tests — 4 passed.
• OpenPI: npm run format:check — passed.
• OpenPI: npm run lint — passed.
• OpenPI: npm run typecheck — passed.
• OpenPI: npm run check — passed.
• OpenPI: npm run test — 980 passed, 1 skipped; Vitest 30 passed.

Impact

• User-visible behavior: None intended.
• Model-visible context/tools: None.
• Runtime/lifecycle: None.
• Persisted config/data: None.
• Compatibility/risk: Release and notification jobs now follow the public automation repository's main branch, so future merged automation changes take effect without an OpenPI SHA-update PR. npm trusted publishing continues to validate the calling release.yml; both caller and reusable workflow grant id-token: write where required. Automation changes remain protected by required review and its behavioral/workflow-contract suite.

[somewan820]

P2 Should-Fix：本 PR 删除了本地 Feishu notifier 与 release validation 的行为/安全测试，仅以 pinned reusable workflow 调用和结构断言替代。tests/github/feishu-pr-notification.test.ts 中的 metadata sanitization、注入、Unicode bounds、secret/HMAC、HTTP response 等契约，以及 release/package/OIDC 边界均不再由本仓库验证。请在 pinned automation revision 中补齐可审查的 contract/smoke coverage，并保留对 draft suppression、secret-pair、sanitization、response validation、tag/version、package integrity 的验证证据。静态审查，未运行测试。