feat: persist release details in consul and post-enable governance on GA

[aaronkvanmeerten]

Summary

When a release is promoted to GA, emit a post-enable governance notification built from the same RP and component versions as the original release. To do that, release-core now persists a full release-details record in Consul KV that set-release-ga reads back.

1. Persist release details at release-core time

After pre-release identifies the RP, release-core writes a JSON record to Consul KV keyed by release number:

releases/<env>/<release-number>/details

{
  "releaseNumber": "240", "environment": "stage-8x8", "rp": "RP-100300",
  "signalVersion": "1184-9295-1.0.7770", "jvbVersion": "8.0-205-g206e038",
  "branch": "release-240", "requestedBy": "...",
  "components": [{"name":"jicofo","version":"1184"}, {"name":"jitsi-meet","version":"9295"}, {"name":"prosody","version":"1.0.7770"}, {"name":"jvb","version":"8.0-205-g206e038"}],
  "createdAt": "2026-06-26T08:00:00Z"
}

Written via scripts/consul-set-release-details.sh — a single PUT to the OCI consul default DC.

2. Reuse at set-release-ga time + post-enable on GA

set-release-ga reads the record (scripts/consul-get-release-details.sh + readJSON) and builds the post-enable call from the stored RP (release.key) and real component versions (release.components) — replacing the old single {name:'core'} placeholder. effectiveAt is the GA moment (now); a gaAt timestamp is written back into the record. source: traffic-manager, progress: {audience: GA}.

Runs after promotion and fails open — governance never blocks a release that is already live. New params: GOVERNANCE_ENABLED/STAGING/VERBOSE, RP_TICKET (optional override; otherwise taken from the stored record).

Supersedes the earlier rp-only consul-set/get-release-rp.sh scripts (folded into the details record).

Dependencies

• jitsi/jenkins-govern8-integration#5 (govern8PostEnableHook)
• infra-customizations-private#1055 (GovernanceHooks.postEnable)

Test plan

• release-core writes the details record to releases/<env>/<release>/details
• set-release-ga recovers it and post-enable carries the real RP + component versions
• gaAt is written back into the record
• GA promotion still succeeds if the record is missing / consul unreachable (fail open); falls back to a single core component
• GOVERNANCE_ENABLED=false skips the notification