Feat: Add build egress hatch and bump allow-list

Two related changes ensuring builds work reliably under harden-runner block mode.

1. build_permit_egress_traffic (implemented as a single harden-runner step)

New optional input (boolean, default false). When true, the python-build job runs harden-runner in audit mode while every other job stays governed by harden_runner_egress. Build lanes fetch dependencies from CDNs that are impractical to enumerate in the egress allow-list; this narrows the exemption to the one job that needs it, instead of dropping every job to audit via harden_runner_egress: 'audit'.

Each job now uses one harden-runner step with the policy computed inline — not two steps (block / audit) selected by a step-level if:. harden-runner declares a pre entry point and no pre-if, so its pre-phase (where the network policy engages) runs regardless of the condition. With two steps both pre-phases engage, block runs first and wins, and the if: only gates the inert main phase — so audit / build_permit_egress_traffic would be silently unreachable. This matches the fix in java-workflows (Fix: Apply one harden-runner step per job).

# non-build jobs
egress-policy: ${{ inputs.harden_runner_egress == 'audit' && 'audit' || 'block' }}

# python-build job (folds in the hatch)
egress-policy: ${{ (inputs.build_permit_egress_traffic || inputs.harden_runner_egress == 'audit') && 'audit' || 'block' }}

The allow-list loads unconditionally (a small fetch audit mode ignores). Default false preserves current behaviour, and the fail-secure default is retained — anything other than an explicit audit request resolves to block.

2. Allow-list bump → .github v0.12.1

The pin moves to @60d8d71016f31c26775e5ec9380eba4264aa6f9e # v0.12.1.

This repository was the furthest behind of the four workflow repos. v0.12.0 added 66 Linux Foundation platform hosts (documentation sites, wikis and Jira tenants; the Nexus/Nexus3 artifact repositories including Docker registry ports 10001–10004; JFrog Artifactory; ReadTheDocs; and Gerrit for Anuket/OPNFV on 443 + 29418), taking the list from 97 to 163. v0.12.1 then adds the Yarn egress endpoints (registry.yarnpkg.com, dl.yarnpkg.com) — Yarn's documented corporate-firewall set, needed so block-mode yarn install succeeds for Yarn-based consumers.

The bump covers every live pin in the repository

Twelve live pins, not just the four reusable defaults:

Verified mechanically (per-file expected occurrence counts). docs/BRIEF.md keeps its original SHA on purpose — a historical record of the pins chosen during the design discussion.

Verification of the pin

• Pinned SHA is the commit the annotated tag resolves to (git rev-list -n 1 v0.12.1 → 60d8d71…), not the tag object.
• Yarn hosts confirmed present in allow_list.txt at the v0.12.1 tag.

Scope & validation

• Single-step fix applied to all four reusable workflows; only the python-build job additionally folds in build_permit_egress_traffic.
• Post-transform checks: no Harden runner (audit) toggle remains anywhere (the block-only steps in the internal/example workflows are single-step and correct); all 12 pins now read v0.12.1; computed egress-policy count = 6 / 6 / 9 / 10.
• actionlint passes on all four reusable workflows.

Note

The branch name still reads …-v0.10.0. Renaming it would close and recreate this PR, so it is left as-is; the pin, commit message and this description all reference v0.12.1.