Relates https://gitlab.com/gitlab-com/gl-infra/production-engineering/-/work_items/28488

Add two security-mirror jobs, gated on the mirror's MERGE_TRAIN=1
schedule, that bridge canonical commits into the mirror while a security
fix awaits public release:

- merge-train-trigger: triggers the shared gitlab-org/merge-train project
  (strategy: depend) to merge canonical:default into security:default,
  authenticated end to end with CI_JOB_TOKEN.
- merge-train-deactivate: turns off the schedule once canonical contains
  the security default-branch HEAD (embargo over); no-op until
  MERGE_TRAIN_SCHEDULE_ID is provisioned.

Add the merge_train_stage input, manitest assertions, and docs.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Address review on merge-train-deactivate:
- Read the security mirror's own branch HEAD with CI_JOB_TOKEN instead of
  CANONICAL_REPO_TOKEN (own-project API, always scoped, no cross-project
  membership dependency, no hard --fail on a membership lapse).
- Document that CANONICAL_REPO_TOKEN toggles the schedule and why it can
  (its service account owns the schedule, per the Terraform module).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

The scheduled self-deactivation was unreliable: merge-train creates
security-only merge commits, so an API check on the post-merge HEAD
rarely trips, and the needs+strategy:depend coupling gated the very
deactivation we wanted.

Deactivation is a correctness requirement (hand control back to the
out-of-box push mirror once the fix reaches canonical), and the reliable
signal is the disclosure event, not a merge-train tick. Ship the bridge
(merge-train-trigger) now; the schedule lifecycle (activate on embargo,
deactivate at disclosure) lands as a follow-up in the publish flow.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

The dev.gitlab.org exclusion is redundant for merge-train-trigger: the job
runs only when MERGE_TRAIN=1, which is set exclusively by the security
mirror's schedule, so the build mirror can never reach the run rule.
Keeps the noCanonical guard. publishRules is unchanged (goreleaser can run
on the build mirror, so noBuild still applies there).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v4.29

See merge request !1695

Apply docker MTU workaround

See merge request !1664

chore(deps): update dependency gitlab-org/labkit to v2.29.2

See merge request !1697

feat(release-platform): add merge-train trigger job

See merge request !1672

## [4.30.0](v4.29.0...v4.30.0) (2026-07-13)