test: exercise workflows in dedicated projects

Plan

1. Configure the two owner-specified isolated workflow test projects with version and namespace inputs.
2. Trigger both default-branch integrations from the catalog after their required image builds.
3. Remove embedded workflow child pipelines, preserve mocked coverage in the ordinary Bash suite, and document/guard every connected test project.

Acceptance criteria

• Dedicated projects use the requested main/version and xrow-public/ci-tools namespace defaults.
• Trunk-based MR and complete default-branch integration checks pass.
• GitFlow MR guard/regressions and complete default-branch integration checks pass.
• Both catalog trigger jobs pass the tested version and current catalog namespace and depend on tools/semantic-release builds.
• All 22 mocked workflow regressions run through the ordinary catalog Bash suite, including five/six-approver boundary coverage; all pass locally.
• Exact branch pipeline lint and final diff/rebase checks pass.
• Required catalog MR CI succeeds, including both real downstream projects: https://gitlab.com/xrow-public/ci-tools/-/pipelines/2981987290.

Closes #417 (closed).

Test project delivery

• Trunk-based setup: xrow-public/test-projects/workflow-trunkbased!1 (merged) (merged). Full default-branch proof: https://gitlab.com/xrow-public/test-projects/workflow-trunkbased/-/pipelines/2981644815; post-merge pipeline also passed.
• GitFlow setup: xrow-public/test-projects/workflow-gitflow!1 (merged). Full default-branch proof: https://gitlab.com/xrow-public/test-projects/workflow-gitflow/-/pipelines/2981676514. This project tests a supported custom permanent development branch, chore/develop, with normal GitFlow protections and no hotfix bypass; default develop behavior stays covered by the existing mocked tests.
• CI Tools job-token access is allowlisted in both projects. For pre-merge default-branch proof, their pending configurations were referenced at immutable commits; original CI configuration paths were immediately restored after pipeline creation.

The general example project remains a broad application integration. Workflow-specific configuration is now independently tested in the two requested isolated projects.

Closes #417 (closed)

Owner feedback implementation

• Removed both templates/workflow-*/test.yml files and their embedded child registrations.
• Documented all three connected test projects in AGENTS.md.
• Guarded every downstream connection by exact GitLab.com host and canonical catalog path; nine host/path boundary cases pass.
• Fixed the stale regression inherited from the new five-approver main-branch policy without reverting that policy.
• Required full new-head MR pipeline passes.

Closes #418 (closed).