ci: harden the Ecosystem Release BOM workflow

[codeforester]

Goal

Remove fragile parsing and duplicated checkout logic from
.github/workflows/ecosystem-release-bom.yml so the release-BOM train is
reproducible and every component row is validated the same way.

Background

From the 2026-09-09 deep review of the release-BOM feature (Base 1.9.0):

1. base-bash-libs API version is read with
   awk -F': ' '$1 == "manifest_version" {print $2; exit}' from
   .dependencies/base-bash-libs/base_api_manifest.yaml
   (ecosystem-release-bom.yml ~line 342). This breaks on quoted values,
   inline comments, or a missing space after the colon.
2. base-demo is checked out two different ways: a manual
   git init / git fetch --depth 1 / git checkout --detach FETCH_HEAD
   into $GITHUB_WORKSPACE/../base-demo in the compatibility job (~line 112),
   versus actions/checkout with path: .dependencies/base-demo in the
   assemble job (~line 295). This area already churned across fix(release): prepare platform prerequisites before BOM checks #2156-fix(release): seed BOM workspace configuration #2159.
3. Component rows for base-cli, base-bash-libs, and base-demo are built
   by inline jq -n with unvalidated api_schema_version strings
   ("base-cli-api@" + $version etc.), while the base row goes through the
   validated bin/base-release-bom-row tool.
4. The concurrency group is
   ${{ github.workflow }}-${{ inputs.base_version }}-${{ inputs.base_ref || github.ref }},
   but base_ref is required: true with no default, so || github.ref is
   dead.

Scope

• Replace the awk YAML read with a YAML-aware step (python -c with
  yaml.safe_load, or yq).
• Use one checkout mechanism for base-demo across both jobs, or factor the
  sibling-layout setup into a composite action / reusable step used by both.
• Generalize bin/base-release-bom-row (cli/python/base_release/release_bom_row.py)
  to accept --repository and --api-schema-version (keeping the current
  basefoundry/base / manifest-1 defaults) and use it to emit all four
  component rows, so each row is schema-validated identically.
• Drop the dead || github.ref from the concurrency group.
• tests/test_github_workflows.py: extend
  test_ecosystem_release_bom_workflow_owns_base_and_required_platform_matrix
  to assert the shared row tool is used for every component and that no
  awk-based YAML parsing remains.
• cli/python/base_release/tests/test_release_bom_row.py: cover the new
  --repository / --api-schema-version arguments.

Acceptance Criteria

• No awk-based YAML parsing remains in the workflow.
• base-demo is checked out by a single mechanism across both jobs.
• All four component rows are produced by bin/base-release-bom-row.
• The concurrency group no longer references github.ref.
• python -m pytest tests/test_github_workflows.py cli/python/base_release/tests/test_release_bom_row.py -q
  passes with the updated assertions.

Validation

python -m pytest tests/test_github_workflows.py \
  cli/python/base_release/tests/test_release_bom_row.py -q
bin/base-test
# optional, if org runners are available:
# gh workflow run "Ecosystem Release BOM" --repo basefoundry/base -f ... (dry inputs)

Non-Goals

• Not converting Ecosystem Release BOM to a pull_request-triggered
  required check.
• No change to the BOM schema, validate_bom, or the release-stack
  validation steps (basectl setup / check / test / demo) themselves.

Project Fields

• Status: Backlog
• Priority: P3
• Size: S
• Area: CI
• Initiative: Contract Hardening
• Milestone: v1.10.0

Agent Assignment

Human first; Copilot candidate after triage. Mechanical hardening with clear
acceptance criteria, but touches a release-critical workflow so wants a
maintainer review.