Automate public API diff reports for in-development .NET releases

[jeffhandley]

Summary

Adds an "API Diff" automation that keeps public API diff report PRs continuously
up to date for the active, not-yet-shipped .NET majors. A scheduled orchestrator
deterministically discovers which diffs should exist from the dnceng NuGet feeds
and dispatches a per-target worker that generates the reports from real published
builds and opens/maintains a draft PR for each one. The automation never
merges -- humans review and merge.

This PR adds only the automation and tooling. No API diff report content is
included; the reports are produced as draft PRs by the workflows after this
merges.

How it works

Discovery (deterministic, no agent). api-diff-orchestrator.yml is a plain
workflow whose discover job runs a C# file-based app, api-diff-discover.cs,
that uses the NuGet client SDK (NuGet.Protocol + NuGet.Versioning) for
SemVer-correct feed queries. maxGA is the highest GA major on dotnet-public;
only maxGA+1 and maxGA+2 are considered. It emits one target per diff, each
pinning the exact previous/current package versions and their feeds, and fans out
to the API Diff Worker workflow via workflow_call (max-parallel 1, matching the
worker's shared concurrency group so a queued target is never dropped).

Two tracks of diffs are produced:

• Major-to-major (cumulative). Current = newest dotnet{major} dev-feed build
  of any prerelease label; baseline = newest (major-1) RC-or-GA build on
  dotnet-public, advancing RC1 -> RC2 -> GA. Identity is keyed on the major and
  kept canonical ((major-1).0-ga_to_major.0) so one evergreen PR is reused as
  the head advances. Content at release-notes/<major>.0/<major>.0.0/api-diff.
• Incremental (milestone deltas). Head is sourced from the dev feed so a
  milestone's draft PR is produced as soon as its build exists (to merge
  before the milestone releases); the baseline is pinned to the previous
  milestone's shipped public build, so a milestone's diff holds off until its
  baseline has shipped. Content under
  release-notes/<major>.0/preview/<milestone>/api-diff.

Generation + publishing (agentic worker). The API Diff Worker workflow,
api-diff-worker.md (compiled to api-diff-worker.lock.yml), is the per-target
worker. Its host generation script, api-diff-generate.sh, positions the working
tree on the publish branch and runs the api-diff skill's RunApiDiff.ps1 against
the target's pinned versions/feeds, gating on completeness (a non-zero generation
exit publishes nothing). The read-only agent then commits the generated
reports and publishes entirely through gh-aw native safe outputs:
create-pull-request / push-to-pull-request-branch open or append to the draft
PR, update-pull-request refreshes the title and body, add-comment posts a run
summary, mark-pull-request-as-ready-for-review flips it Ready when the milestone
is code-complete, and noop covers the silent path. A post-step re-validates the
agent-written state block against the host-authored target before anything is
published.

Safety and robustness

• Draft PRs only; never merges. Humans own review and merge.
• Least privilege. The agent job is read-only; every GitHub write runs in a
  separate, permission-controlled safe-output job constrained to the automation
  • api-diff labels and an allowed-files allowlist scoped to the api-diff
    report tree plus the two global exclusion files (release-notes/ApiDiff*ToExclude.txt).
    Nothing outside that allowlist can be written; the default protected-file check
    is kept, excluding only the per-folder api-diff/README.md index the reports
    legitimately produce.
• Fork-safe. Discovery and the worker are gated to the canonical repo; a fork
  runs them only via manual workflow_dispatch, so forks never open spurious PRs.
• Idempotent. An unchanged build is a silent no-op; identity is anchored to a
  visible YAML state marker in the PR body so runs never create duplicates.
• Human bootstrapping. A person can hand-start an API diff PR (on the target
  branch, or an opted-in automation + api-diff PR) and the automation adopts
  and maintains it thereafter. A PR labeled only api-diff stays human-owned and
  blocks the automation for that content.
• Reviewer feedback. The worker folds in reviewer feedback on its next
  scheduled run using GitHub integrity filtering (min-integrity: approved), so
  only write-access or maintainer-endorsed feedback reaches the agent; it never
  triggers on review events and applies no trust handling of its own.

Commit walkthrough

1. Upgrade gh-aw to v0.80.9 -- prerequisite tooling bump. Renames the
   dispatcher agent, adds its skill, and recompiles existing workflows, so this
   commit also regenerates unrelated lock files (release-notes.lock.yml,
   agentics-maintenance.yml, action pins). Tooling-only churn.
2. Refactor api-diff skill into pure generation plus validation -- api-diff
   becomes pure report generation (RunApiDiff.ps1); a new api-diff-validation
   skill owns the dotnet-inspect verification. RunApiDiff.ps1 accepts any
   <label>.N prerelease build and hardens temp-folder cleanup.
3. Add API Diff Orchestrator workflow -- deterministic discovery
   (api-diff-orchestrator.yml + api-diff-discover.cs) and the two-track model.
4. Add API Diff Worker workflow -- the per-target worker (api-diff-worker.md
   / api-diff-worker.lock.yml) and its host generation script
   (api-diff-generate.sh), publishing through gh-aw native safe outputs.
5. Adopt human-bootstrapped API diff PRs -- adoption rules for hand-started
   PRs.
6. Add support for incorporating PR feedback -- integrity-filtered reviewer
   feedback handling and the delimited state block.

Two trailing commits satisfy super-linter on the host shell script: marking
api-diff-generate.sh executable (bash-exec) and an shfmt formatting fix.

Notes for reviewers

• All agentic jobs run in the repo's copilot-pat-pool environment per the
  existing PAT pool mechanism.
• Validated end-to-end on a simulation fork of this repository:
  from an empty net11 state it produces the major-to-major draft PR plus the full
  preview.1 through preview.6 incremental draft PRs, correctly holding off
  preview.7 until its baseline ships. The linked pull requests show the generated
  draft PRs and the commit-by-commit progression as each build advanced.