fix(publish-runtime): align cascade list to 4 supported runtimes

[HongmingWang-Rabbit]

Summary

The cascade TEMPLATES list at publish-runtime.yml:330 had drifted from manifest.json:

	Templates
Cascade dispatches today	claude-code, langgraph, crewai, autogen, deepagents, hermes, gemini-cli, openclaw (8)
manifest.json supports (after #2536)	claude-code, hermes, openclaw, codex (4)

Two consequences of the drift:

1. codex was never in the cascade — added to manifest in feat: register codex runtime + runtime native-MCP design docs #2512 but the cascade list wasn't updated. Fresh runtime publishes did not trigger a codex template rebuild; codex stayed pinned to whatever runtime version it last saw at its own image-build time. Likely root cause of any "codex stuck on stale runtime" symptoms.
2. 5 deprecated templates (langgraph, crewai, autogen, deepagents, gemini-cli) — pruned from manifest by chore(manifest): prune to 4 actively-supported runtimes #2536 — were still receiving cascade dispatches. Wasted API calls, and green CI on dead repos masks "this template is dead, stop maintaining it."

After this PR, TEMPLATES="claude-code hermes openclaw codex" matches manifest.json workspace_templates exactly.

Surfaced during the RFC #388 (fast workspace provision) prior-art audit.

Long-term

The data fix alone leaves the underlying drift hazard — manifest changes still need a manual cascade-list update. RFC #388 captures the structural fix (derive TEMPLATES from manifest.json so this can't drift again) as a Phase-1 invariant of the bake pipeline. Don't bundle that here — keep this PR focused on the immediate data correction.

Test plan

• YAML validates (python3 -c "import yaml; yaml.safe_load(...)")
• Diff is data + comment only; no job/step structure changes
• CI green on this branch
• On merge to staging: confirm next runtime auto-publish dispatches to exactly 4 repos (claude-code, hermes, openclaw, codex), no others
• Verify codex template image rebuilds against the new runtime version (was previously skipped)

🤖 Generated with Claude Code

[HongmingWang-Rabbit]

Self-review (five-axis, code-review-and-quality skill)

Correctness ✓ — Cascade list matches manifest.json workspace_templates exactly (4 entries, suffix-mapping correct). Codex gap since #2512 verified; 5 deprecated entries removed per #2536. Cascade loop's soft-fail-per-template behavior unchanged.

Readability ✓ — 6-line comment answers the WHY (hardcoded list, why these 4, why not auto-derived) that future readers would ask; matches the file's existing explanatory-comment convention.

Architecture ✓ — Doesn't change the mechanism, only the data. Structural manifest↔cascade gate is correctly deferred to RFC #388 Phase 1 ("don't bundle" per round-1 reviewer guidance).

Security ✓ — No secrets, no new inputs, no trust-boundary changes.

Performance ✓ (net positive) — 4 dispatches instead of 8 halves cascade tail latency and saves 4 wasted GH API calls per publish.

Verification

• ✓ YAML validates
• ✓ CI: 20 SUCCESS, 1 SKIPPED, 0 PENDING/FAILURE
• ✓ Approved
• ✓ Mergeable: CLEAN, queued

Findings (informational, not blocking)

FYI: Pre-existing fragility at lines 347–351 — if all dispatches fail (e.g., token narrowed to no-permission), job warns but exits 0. Token-missing is already gated (lines 314–323 hard-fail on push), but a partially-narrowed token would silently warn forever. Worth a separate follow-up issue.

Nit: Comment cites RFC #388 in molecule-controlplane (private) from this public repo. Cross-repo private→public link works for org members but is opaque to external readers. Consider mirroring the structural-fix tracker into molecule-core too. Not blocking.

Verdict

Approve. Definitely improves overall code health. Already approved + queued; this comment is for the record.