fix(release): follow managed testsuite v1

[bketelsen]

What does this change?

Bluefin stable promotion passes test_ref: v1 to testsuite, but the nested reusable workflow itself is pinned to an older SHA. That updates checked-out tests while freezing workflow-level fixes such as testsuite#691's VM disk sizing, so the NVIDIA release gate would remain blocked after the testsuite fix merges.

• call the trusted first-party testsuite workflow through its managed @v1 tag
• disable Renovate management for that dependency so config:best-practices cannot restore the stale digest pin
• document the separate workflow-definition and test-checkout refs

The Security Gate for moving this first-party workflow to managed v1 was explicitly approved during implementation. Runtime recovery still depends on testsuite#691 and testsuite#692 passing review and live E2E validation.

Validation

• pre-commit run --files .github/workflows/reusable-execute-release.yml .github/renovate.json5 docs/skills/composite-actions/reusable-workflow.md
• actionlint .github/workflows/reusable-execute-release.yml
• python3 scripts/check-self-repository-references.py
• python3 scripts/check-consumer-contract.py
• renovate-config-validator --strict .github/renovate.json5 with Renovate 44.14.7

Consumer validation

Consumer PR: projectbluefin/bluefin#1014
Consumer CI run: https://github.com/projectbluefin/bluefin/actions/runs/31193252427
Out-of-org consumer impact: N/A — GitHub code search found no ublue-os/* references to reusable-execute-release.yml; build workflows and composite actions are unchanged.

• Opened a draft consumer PR using the documented @v1 contract
• Linked a passing consumer CI run that exercised this branch before merge; fork refs cannot safely receive inherited release secrets, so live release-gate validation remains a maintainer step
• Evaluated out-of-org consumers and documented the impact above

Checklist

• I am using an agent and I take responsibility for this PR
• Conventional commit message
• No hardcoded secrets or credentials

Refs projectbluefin/bluefin#929

[joshyorko]

I replayed this change onto current actions/main (cad7d15) to remove the uncertainty around the conflict. The only conflict is the release-gate uses: line; resolving it to the PR's intended projectbluefin/testsuite/.github/workflows/e2e.yml@v1 produces the original three-file change cleanly.

Current projectbluefin/bluefin:testing already calls the same Testsuite workflow at @v1, so the consumer side is aligned. The rebased patch passes the scoped pre-commit hooks (YAML, actionlint, floating-tag policy, consumer contract), check-self-repository-references.py, check-consumer-contract.py --verbose, YAML parsing, and Renovate 44.14.7 strict validation.

Could you rebase/update this branch when you have a chance? I am deliberately not opening a duplicate PR.