fix: canonical workflow improvements — stale action SHAs, publish.yml modernisation, and reusable rule workflows

[Justus-at-Tazama]

Summary

Several improvements to the canonical workflow files in this repo have been identified. This issue tracks all pending changes and serves as a running change log — each change made to a canonical file in this repo during the current work cycle will be recorded as a comment on this issue.

---

1. publish.yml — stale action versions and Node 16

publish.yml currently uses outdated action versions and an EOL Node.js runtime:

Item	Current	Target
actions/checkout	@v3	@v4
actions/setup-node	@v3	@v4
node-version	16.x	20.x

Node.js 16 reached end-of-life in September 2023. actions/checkout@v4 and actions/setup-node@v4 have been available and stable since late 2023.

Note: Node 16 removal from node.js.yml is tracked separately in #63. This item covers publish.yml specifically.

Acceptance criteria:

• publish.yml uses actions/checkout@v4 and actions/setup-node@v4
• publish.yml uses node-version: '20.x' (or lts/*)
• Change propagated to all downstream frmscoe repos via sync

---

2. package-rule.yml + package-rule-rc.yml — promote to reusable workflows

Every frmscoe rule repo (33 repos) plus tazama-lf/rule-901 and tazama-lf/rule-902 each carry their own full copy of these two files — 70 nearly-identical files maintained individually.

The right solution is to define these as reusable workflows with workflow_call inputs here in canonical, allowing each downstream repo to have a thin caller file instead of a full job definition.

Known issues with current copies to fix in the canonical form:

• Docker image tag is hardcoded as 3.0.0 in all copies — must be dynamic (derived from package.json or passed as a workflow input)
• rule-002 has a more robust implementation (reads existing dependency version from rule-executer/package.json before overwriting) — adopt this pattern as canonical

Acceptance criteria:

• package-rule.yml defined as a reusable workflow_call with rule_number input (and optionally image_tag)
• package-rule-rc.yml same treatment
• Dynamic version tag replaces hardcoded 3.0.0
• Canonical implementation uses the rule-002 defensive pattern for dependency version checking
• All 35 downstream rule repos updated to call the reusable workflow

---

Related

• frmscoe/workflows#63 — Node 16 removal from node.js.yml (parallel track)
• tazama-lf/workflows#23 — equivalent canonical improvements for tazama-lf/workflows