ci: notify the Home Assistant app repository on every beta and stable release

[HuggeK]

Part of #1233. Companion: srcfl/home-assistant-addons#8 rebuilds the app repository so it can consume these events.

beta.yml and release-assets.yml gain a final job that sends repository_dispatch ftw-release to srcfl/home-assistant-addons once the release and its digest receipt exist. That repository's sync-upstream.yml already listens for this event type; today it only polls hourly, and its build is broken by #1083.

The job uses a new secret, HA_ADDON_DISPATCH_TOKEN. When it is unset the job logs a notice and succeeds, so this can merge before the secret exists and a release is never blocked by the app repository.

Secret setup (owner)

• A fine-grained personal access token or GitHub App token with Contents: read and write on srcfl/home-assistant-addons only. repository_dispatch needs write access to the target repository, and the job-scoped GITHUB_TOKEN cannot reach another repository.
• Store it as HA_ADDON_DISPATCH_TOKEN under Settings → Secrets and variables → Actions in srcfl/ftw.
• It is repository setup, not a release step, like LEGACY_GHCR_TOKEN. AGENTS.md gets one paragraph saying so.

What the app repository does with the event

The payload (channel, tag, commit, plus source_beta for stable) is informational. The receiving sync reads FTW's GitHub releases, downloads ftw-image-digests.json (beta) or ftw-promotion-receipt.json (stable), and checks the Core image digest and OCI labels in the registry before pinning anything. A forged or wrong payload cannot make it publish a different image.

Validation: CI-only change plus a Markdown paragraph, so no changeset (allowlisted). The dispatch has not run end to end because it needs the secret in srcfl/ftw; the call is the documented POST /repos/{owner}/{repo}/dispatches form via gh api, and the receiving repository's tests cover the event type.

🤖 Generated with Claude Code

https://claude.ai/code/session_014Mn3h7AgWsYcNgPGSCBU62

[miravoss26]

Adds a repository_dispatch job to beta.yml/release-assets.yml that pings srcfl/home-assistant-addons on release, so its hourly sync doesn't have to wait.

• Security: the new secret HA_ADDON_DISPATCH_TOKEN is scoped read/write on the target repo only, degrades to a no-op notice when unset, and the job is gated github.repository == 'srcfl/ftw' so a fork can't fire it with the org's token. The payload (channel/tag/commit) is informational — the receiving side verifies against the GitHub release and registry digest, so a forged dispatch can't publish anything.
• Correctness: matches the PR description. CI green (Core/Windows builds, brand-cleanup, changeset-check, repo hygiene all pass).

Safe to merge from my read.