Close the drift loop: hunk output in failure issues, pin-bump dispatch on release-src publish

[ronaldtse]

Roadmap item 17 — no human touches the ruby-new-release drift loop.

The loop

1. release-monitor (existing, daily cron) detects a new official ruby, onboards it (versions.yml + manifests), and opens an onboarding PR. This PR extends what the failure path carries: Onboarder::Result now exposes failures (patch name → git apply output), so the auto-filed issue contains the failing hunk output, not just patch names. Re-running with no new release still does nothing (empty detect matrix).
2. release-src publish now records the published tag in a small release-tag artifact (works for both trigger paths: tag push and manual dispatch, where the tag otherwise isn't recoverable from the workflow_run payload).
3. New runtime-pin-bump.yml: on workflow_run(release-src, conclusion: success) it reads the tag back from that artifact and fires a repository_dispatch (event tfs-ruby-src-release, payload tag) to tamatebako/tebako-runtime-ruby using the TEBAKO_CI_PAT_TOKEN secret — the same gh api .../dispatches cross-repo mechanism release-monitor already uses; no new secrets. The runtime repo (companion PR) opens a DEFAULT_RELEASE pin-bump PR on a bot/source-pin-<tag> branch; its CI matrix runs on the PR; nothing auto-merges.

Idempotent: a re-dispatched tag no-ops downstream (pin already there or branch exists). No force-pushes anywhere.

Testing

• bundle exec rspec: 61 examples, 0 failures (onboarder spec now asserts the hunk output; the bogus-patch fixture was made well-formed so it fails as a real context mismatch, not 'corrupt patch').
• actionlint: new/changed files clean (two pre-existing shellcheck infos in untouched steps remain).
• Not testable locally: the workflow_run → artifact → dispatch chain and the PAT's permissions (runs only on GitHub). Note the PAT was flagged stale in earlier release worklogs — if it was not rotated since, the dispatch step will fail loudly and a manual gh api repos/tamatebako/tebako-runtime-ruby/dispatches -f event_type=tfs-ruby-src-release -F 'client_payload[tag]=<tag>' is the fallback.