ci(release): adopt verified release PR pipeline

.github/workflows/release-prepare-trigger.yml

@@ -0,0 +1,49 @@
+name: Trigger release preparation
+
+on:
+  workflow_run:
+    workflows: ["Test"]
+    types: [completed]
+
+permissions: {}
+
+concurrency:
+  group: release-prepare-trigger
+  cancel-in-progress: false
+
+jobs:
+  dispatch:
+    name: Dispatch tested master
+    if: >-
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'push' &&
+      github.event.workflow_run.head_branch == 'master'
+    runs-on: ubuntu-latest
+    permissions:
+      actions: write
+      contents: read
+    steps:
+      - name: Dispatch exact current master
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        env:
+          TESTED_SHA: ${{ github.event.workflow_run.head_sha }}
+        with:
+          script: |
+            const testedSha = process.env.TESTED_SHA;
+            if (!/^[0-9a-f]{40}$/.test(testedSha)) {
+              throw new Error(`Invalid tested SHA: ${testedSha}`);
+            }
+            const { owner, repo } = context.repo;
+            const master = await github.rest.git.getRef({ owner, repo, ref: 'heads/master' });
+            if (master.data.object.sha !== testedSha) {
+              core.notice(`Skipping stale tested SHA ${testedSha}; master is ${master.data.object.sha}.`);
+              return;
+            }
+            await github.rest.actions.createWorkflowDispatch({
+              owner,
+              repo,
+              workflow_id: 'release-prepare.yml',
+              ref: 'master',
+              inputs: { targetSha: testedSha },
+            });
+            core.notice(`Dispatched release preparation for tested master ${testedSha}.`);