D0.2 Site CI guard verification and the community-base release advisory workflow

[alexeygrigorev]

Plan issue: community-base docs/plan/phase-0.md D0.2. Depends on D0.1a (merged, 426b038's parent series).

Goal

Keep the tagged community-base pin honest: verify the existing fail-closed source guard protects main CI, and add a weekly release-inspection workflow that opens exactly one deduplicated update advisory when a newer community-base release exists. No pins auto-change.

Scope

• Verify scripts/check_community_base_source.py (installed in D0.1a, wired at ci.yml "Check community-base dependency source") rejects local-link/path/branch fixtures and accepts the approved tag.
• Add a scheduled + manually dispatchable workflow: look up the latest DataTalksClub/community-base release, compare with the pin. Same -> "already latest", exit 0. Newer -> one deduplicated advisory issue (search-and-update by marker title) with the role pipeline (PM, engineer, tester, PM acceptance, local merge/push). Lookup failure -> nonzero exit with an actionable message. Never edits pyproject.toml/uv.lock.

Non-goals

• Automatic pin bumps; selecting an adoption-incompatible domain release (the advisory only reports).
• The AISL advisory workflow (separate site issue, same flow).

Acceptance criteria

• Guard rejects a local-link fixture and accepts the pinned tag (script run against fixtures, exit codes recorded)
• Manual workflow dispatch with latest already pinned -> "already latest", no issue
• Lookup failure path exits nonzero
• Advisory issue creation is deduplicated (second run updates the same issue, does not open another)