feat(rake): cascade input — one reusable, least-privilege caller (closes #362)

[ronaldtse]

Summary

Closes #362. Supersedes #376.

Consolidated model-driven design — one reusable, one concern, extended via input. Rejects the sibling-workflow fragmentation in #376 (144-line near-duplicate of generic-rake.yml).

What lands

• .github/workflows/generic-rake.yml — new cascade boolean input (default true). tests-passed job gated by if: inputs.cascade. Existing consumers unchanged.
• cimas-config/gh-actions/master/rake_test_only.yml — thin caller (cascade: false, permissions: contents: read). Not a second reusable.
• VARIANT_REGISTRY row for the caller-template pair (class g drift-audit) — delta 18, verified.
• docs/generic-rake.md — documents the input, when to use cascade-off, when not to.

Why not #376's shape

#376 (sibling reusable)	This PR (cascade input)
144-line copy of matrix job body	Matrix body stays in ONE place
Two reusables to keep in sync	One reusable; caller is 15 lines
No class (g) registration	Registered at introduction
Drift risk on every matrix change	Impossible to drift the matrix

Issue #362 itself listed this as Option 2. Option 1 (split reusables) was the #376 path; we take Option 2 because GHA still needs a thin caller-template variant for the static permissions: block, but the reusable itself must not be duplicated.

Test plan

• YAML parses
• PHASE_5_VARIANT_DRIFT_ONLY=1 — all 4 registry entries in sync
• CI actionlint on this PR
• Existing cascade consumers: no behaviour change (cascade defaults true)
• Post-merge: opt-in wave maps sample/model repos to master/rake_test_only.yml

[opoudjis]

Rejecting this PR as violating the standing rule you injected on ci#375 (comment) at 10:12Z — 30 minutes before this PR merged:

Standing rule: never curl raw scripts from main; encapsulate as composite actions and pin tags.

The new template pins to a floating branch:

uses: metanorma/ci/.github/workflows/generic-rake.yml@main

Per your own standing rule and the three-tier discipline codified in #372 (consumers pin @v1 for moving-major), this should be @v1. Please remediate.

Minor: caller passes pat_token: ${{ secrets.METANORMA_CI_PAT_TOKEN }} even though the cascade-off variant does not participate in the release cascade the PAT is needed for. Empty-secret-fallback prevents hard failure, but declares intent to use a token this variant shouldn't need.

Structure otherwise clean: cascade input + gated tests-passed + thin caller + VARIANT_REGISTRY registration are correct.

🤖