Replaces the release-platform-publish placeholder with a dynamic child
pipeline that checks commit visibility before deciding how to run the
sync job.

generate-publish-pipeline calls the GitLab API to check whether
CI_COMMIT_SHA is present on the canonical project. If it is, the
downstream sync job runs automatically (SYNC_TYPE=on_success); if not,
it requires a manual trigger (SYNC_TYPE=manual). Network failures fall
back to manual rather than failing the job. Gated to security mirror
only when release_platform_enabled=true via the noCanonical.noBuild guard
plus an explicit release_platform_enabled!=true never rule.

trigger-publish-pipeline triggers the generated child pipeline with
strategy: depend. Defined outside job.new() since trigger jobs cannot
have script, extends, or after_script.

The child pipeline contains a stub sync-artifacts job in this MR; actual
skopeo copy and package sync follow in MR 2 and MR 3.

New inputs: canonical_project_id (project ID to check for commit
visibility; empty means always manual), release_platform_enabled (existing
pattern via component.releasePlatformInput).

Part of delivery#22003 (MR 1 of 4).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat: add publish stage smart sync mechanism (MR 1/4)

See merge request !1435

## [3.20.0](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/compare/...) (2026-04-23)

### Features

* add publish stage smart sync mechanism ([0d3170be](0d3170be)), closes [delivery#22003](https://gitlab.com/gitlab-com/delivery/-/issues/)