Run dependency explanations separately from main AMD canaries

[zozo123]

Let main AMD canaries finish without waiting for detailed dependency upgrade explanations, while keeping those diagnostics available to maintainers.

Explaining each outdated package can require a full dependency resolution. As the number of outdated packages grows, this advisory work can delay the canary even when image builds and tests get faster. Separating the report addresses that delay without reducing test coverage or dependency validation.

For scheduled and manually dispatched AMD runs on main, the canary keeps the quick dependency freshness summary and saves the constraints it analyzed. After completion, a separate Dependency upgrade report workflow checks out the tested revision and loads the original CI image and saved constraints from that run. It also runs after a failed canary when the required artifacts are available. Python 3.10 remains summary-only; other run types and release branches keep their existing behavior.

The report validates the source repository, branch, workflow, and event; uses read-only permissions; runs at most three jobs concurrently; and saves partial output if a job fails or reaches its 90-minute limit. Maintainers can use Re-run jobs on the report (or gh run rerun REPORT_RUN_ID) while the original inputs and image remain available, normally two days. Reruns preserve the source canary ID and fail if the original inputs have expired. The report uses only workflow_run, so it cannot write to the default branch cache. Missing or expired inputs fail the report rather than substituting newer artifacts. PyPI metadata is fetched at report time, so available upgrade targets can change.

The resolver also skips a redundant pinned resolution when the shared unconstrained baseline already selects the latest version. --constraints-file lets the quick summary and the later report analyze the same saved constraints.

Moving explanations to another workflow removes them from the canary completion path; it does not by itself reduce total runner minutes. The resolver shortcut can save runner time. Measure wall-clock improvement after merge, and include both workflows when comparing runner usage.

Validation:

• All 32 focused tests passed: 15 dependency-check tests and 17 workflow-planning regression cases, including original-input reuse, missing or expired artifacts, invalid source IDs, and provenance rejection.
• Fast and manual prek checks passed, including workflow lint and security checks.
• The full Breeze unit suite passed: 1,291 tests.
• All seven integration tests were skipped because SVN is unavailable in the local container.

The new reporting workflow still needs end-to-end validation on a qualifying main canary after merge.

---

Was generative AI tooling used to co-author this PR?

• Yes — Codex (GPT-6)

Generated-by: Codex (GPT-6) following the guidelines

---

• Read the Pull Request Guidelines for more information.