The jsonnet_test job omitted src/ci/templates, so the templates
manitests (including golang.manitest.jsonnet) never executed in CI. Add
-J src/ci/templates and src/ci/templates/*.manitest.jsonnet to the
invocation, mirroring how the component manitests rely on
-J src/ci/components.

Extend golang.manitest.jsonnet beyond shape checks to assert the
rendered templates/golang.yml forwards inputs into the go-test include:
integration_services, integration_test_args, validate_stage ->
test_stage/post_test_stage, the go-test include gated on
release_platform_enabled, and the go-contract-test wiring gated on
contract_testing_enabled.

Refs #59

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Relates https://gitlab.com/gitlab-com/gl-infra/production-engineering/-/work_items/28488

Add two security-mirror jobs, gated on the mirror's MERGE_TRAIN=1
schedule, that bridge canonical commits into the mirror while a security
fix awaits public release:

- merge-train-trigger: triggers the shared gitlab-org/merge-train project
  (strategy: depend) to merge canonical:default into security:default,
  authenticated end to end with CI_JOB_TOKEN.
- merge-train-deactivate: turns off the schedule once canonical contains
  the security default-branch HEAD (embargo over); no-op until
  MERGE_TRAIN_SCHEDULE_ID is provisioned.

Add the merge_train_stage input, manitest assertions, and docs.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Address review on merge-train-deactivate:
- Read the security mirror's own branch HEAD with CI_JOB_TOKEN instead of
  CANONICAL_REPO_TOKEN (own-project API, always scoped, no cross-project
  membership dependency, no hard --fail on a membership lapse).
- Document that CANONICAL_REPO_TOKEN toggles the schedule and why it can
  (its service account owns the schedule, per the Terraform module).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

The scheduled self-deactivation was unreliable: merge-train creates
security-only merge commits, so an API check on the post-merge HEAD
rarely trips, and the needs+strategy:depend coupling gated the very
deactivation we wanted.

Deactivation is a correctness requirement (hand control back to the
out-of-box push mirror once the fix reaches canonical), and the reliable
signal is the disclosure event, not a merge-train tick. Ship the bridge
(merge-train-trigger) now; the schedule lifecycle (activate on embargo,
deactivate at disclosure) lands as a follow-up in the publish flow.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

The dev.gitlab.org exclusion is redundant for merge-train-trigger: the job
runs only when MERGE_TRAIN=1, which is set exclusively by the security
mirror's schedule, so the build mirror can never reach the run rule.
Keeps the noCanonical guard. publishRules is unchanged (goreleaser can run
on the build mirror, so noBuild still applies there).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v4.29

See merge request !1695

Apply docker MTU workaround

See merge request !1664

chore(deps): update dependency gitlab-org/labkit to v2.29.2

See merge request !1697

Follow-up to !1664. The --mtu 1360 workaround was documented only as a
YAML comment, which is invisible in pipeline logs. Emit a single-line
runtime warning so anyone reviewing build output knows a reduced MTU is
temporarily in effect and where to track its removal.

Relates https://gitlab.com/gitlab-com/gl-infra/production-engineering/-/work_items/28488

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

feat(release-platform): add merge-train trigger job

See merge request !1672

## [4.30.0](v4.29.0...v4.30.0) (2026-07-13)

fix(docker): warn at build time that a reduced MTU workaround is in use

See merge request !1701

## [4.30.1](v4.30.0...v4.30.1) (2026-07-13)

test(golang): run templates manitests in CI and assert go-test forwards

See merge request !1642

chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v4.30

See merge request !1702

fix(renovate): run terraform-docs only in directories containing Terraform files

See merge request !1703

## [4.30.2](v4.30.1...v4.30.2) (2026-07-15)