docs(tenants): TENANTS.md points publish-app at the archived reusable-workflows repo

[devantler]

🤖 Generated by the Daily AI Engineer

Evidence

docs/TENANTS.md (~line 135) tells tenant authors their cd.yaml calls publish-app.yaml from devantler-tech/reusable-workflows. That repo is archived — the workflow now lives in devantler-tech/actions.

The platform's own policy comment already records the move: k8s/bases/infrastructure/cluster-policies/.../verify-app-images.yaml (~lines 53-66) notes publish-app moved into the actions monorepo. The current tenant scaffold agrees — gitops-tenant-template's .github/workflows/cd.yaml calls devantler-tech/actions/.github/workflows/publish-app.yaml.

Audience and impact

A tenant author following TENANTS.md is pointed at an archived repository. Nothing breaks today — verify-app-images' attestor subjectRegExp still accepts both identities during the transition — so this is a correctness/onboarding problem, not an outage. It becomes a real breakage if the transitional regex is ever tightened to the actions identity alone.

Expected behaviour

TENANTS.md cites devantler-tech/actions as the home of publish-app.yaml.

Acceptance criteria

• TENANTS.md references devantler-tech/actions for publish-app.yaml
• No remaining reusable-workflows references in docs/TENANTS.md
• Any sibling doc citing the same path is updated in the same PR

Rough size: XS (doc-only).

Found while auditing tenant-scaffold/platform lockstep for gitops-tenant-template#6.

[coderabbitai]

🔗 Related PRs

#2399 - feat: accept devantler-tech/actions cosign subjects during the publish-workflow repoint [merged]
#2404 - fix: tenant artifact verification rejects the dual signing identities from #2399 [merged]
#2408 - fix(rgd): single regex-alternated cosign identity for tenant artifact verification [merged]
#2429 - fix(policy): trust the actions publish-app identity for app-image verification [merged]
#2457 - fix(talos): accept the actions publish-app identity at node image verification [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!