ci(reusables): gate Radicle mirror + Instant Sync dispatch on secret presence (auto-fixes 65 repos) (#305)

## Summary

Two source-level fixes in shared workflows. Zero fan-out PRs needed —
both fixes auto-propagate to every caller via the existing
reusable/standalone patterns.

## Fix 1: `mirror-reusable.yml` mirror-radicle (26 repos auto-fixed)

**Root cause:** mirror-radicle's three working steps fired
unconditionally when `vars.RADICLE_MIRROR_ENABLED == 'true'`, even when
`secrets.RADICLE_KEY` was empty. The `echo > ~/.radicle/keys/radicle`
write also failed because the parent directory `~/.radicle/keys/`
doesn't exist by default.

**Fix:**
- `if: \${{ secrets.RADICLE_KEY != '' }}` on Setup Rust / Install
Radicle / Mirror to Radicle steps
- `mkdir -p ~/.radicle/keys` before the key write
- New inverse-gate "Skipped" advisory step that prints a `::notice`
instead of failing

## Fix 2: `instant-sync.yml` dispatch (39 repos auto-fixed)

**Root cause:** `peter-evans/repository-dispatch` ran unconditionally on
every push; without `secrets.FARM_DISPATCH_TOKEN` the action falls back
to `GITHUB_TOKEN`, which cannot dispatch cross-repo and returns HTTP 401
"Bad credentials".

**Fix:**
- `if: \${{ secrets.FARM_DISPATCH_TOKEN != '' }}` on the Trigger
Propagation step
- Inverse-gate `::notice` advisory step

## Why source-level

Both files are imported via `workflow_call` / direct-paste templates
across ~289 estate caller wrappers. Source-level gate = automatic
per-repo fix.

## Owner action for full activation (optional)

- mirror-radicle: configure `RADICLE_KEY` (per-repo or org-level
secret).
- instant-sync: configure org-level `FARM_DISPATCH_TOKEN` PAT with repo
scope.

This PR makes those owner actions **optional** — without the secret the
workflow is no-op; with the secret it works.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/instant-sync.yml

@@ -15,7 +15,15 @@ jobs:
   dispatch:
     runs-on: ubuntu-latest
     steps:
+      # Gate the cross-repo repository_dispatch on FARM_DISPATCH_TOKEN
+      # being configured. Without the PAT, peter-evans/repository-dispatch
+      # falls back to GITHUB_TOKEN — which cannot dispatch cross-repo and
+      # returns HTTP 401 "Bad credentials", failing the job. Caught 39
+      # estate repos on the 2026-05-30 audit. With this gate the workflow
+      # gracefully skips on repos where the secret has not been
+      # propagated, instead of red-ing main on every push.
       - name: Trigger Propagation
+        if: ${{ secrets.FARM_DISPATCH_TOKEN != '' }}
         uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3
         with:
           token: ${{ secrets.FARM_DISPATCH_TOKEN }}
@@ -29,6 +37,13 @@ jobs:
               "forges": ""
             }
 
+      - name: Skipped (FARM_DISPATCH_TOKEN not configured)
+        if: ${{ secrets.FARM_DISPATCH_TOKEN == '' }}
+        env:
+          REPO_NAME: ${{ github.event.repository.name }}
+        run: |
+          echo "::notice::FARM_DISPATCH_TOKEN secret not configured on ${REPO_NAME}; skipping cross-repo dispatch. Configure the org-level FARM_DISPATCH_TOKEN PAT (repo scope) to enable instant forge propagation."
+
       - name: Confirm
         env:
           REPO_NAME: ${{ github.event.repository.name }}

.github/workflows/mirror-reusable.yml

@@ -156,16 +156,34 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+      # All Radicle steps gate on secrets.RADICLE_KEY being set on the
+      # caller repo (resolved via `secrets: inherit`). Without this gate
+      # the workflow burned ~3 minutes of Rust+Radicle install on every
+      # push to every RADICLE_MIRROR_ENABLED repo only to fail at
+      # `~/.radicle/keys/radicle: No such file or directory` because the
+      # `echo "" > ...` write into a non-existent dir errors out — and
+      # even if the dir existed, the empty-key write would never sync.
+      # Caught 26 estate repos on the 2026-05-30 audit. The vars gate
+      # answers "is Radicle mirror desired here?"; the secret gate
+      # answers "are we configured to actually do it?".
       - name: Setup Rust
+        if: ${{ secrets.RADICLE_KEY != '' }}
         uses: dtolnay/rust-toolchain@efa25f7f19611383d5b0ccf2d1c8914531636bf9 # stable
         with:
           toolchain: stable
       - name: Install Radicle
+        if: ${{ secrets.RADICLE_KEY != '' }}
         run: |
           cargo install radicle-cli --locked
           echo "$HOME/.cargo/bin" >> $GITHUB_PATH
       - name: Mirror to Radicle
+        if: ${{ secrets.RADICLE_KEY != '' }}
         run: |
+          mkdir -p ~/.radicle/keys
           echo "${{ secrets.RADICLE_KEY }}" > ~/.radicle/keys/radicle
           chmod 600 ~/.radicle/keys/radicle
           rad sync --announce || echo "Radicle sync attempted"
+      - name: Skipped (RADICLE_KEY not configured)
+        if: ${{ secrets.RADICLE_KEY == '' }}
+        run: |
+          echo "::notice::RADICLE_MIRROR_ENABLED=true but secrets.RADICLE_KEY is empty. Skipping Radicle mirror. Configure the RADICLE_KEY org/repo secret to enable."