Plan task 6 of MIL-004: move the embedded scripts to files

The sync and publish-wiki scoped workflows embed 200 to 300 lines of Python
in their YAML. Add task 6 to move them to tools/ and run them from a
checkout of this repository, as verified from two organisations, with a
Go/No-Go criterion and O2 in the traceability. Review and accept the
amendment (RC-034) and update TM-001.

docs/milestones/mil-004-versioned-release.md

@@ -9,8 +9,8 @@
 ## Version History
 | Date | Status | Author | Reviewer | Change | Commit |
 | --- | --- | --- | --- | --- | --- |
-| 2026-10-03 | Deprecated | Jens Tirsvad Nielsen | S01 | Owner is S05 (security authority); S01 remains approving reviewer | [4de5438] |
 | 2026-10-10 | Accepted | Jens Tirsvad Nielsen | S01 | Target date 2026-11-28 confirmed on 2026-10-10 by S01 (stand-in for S05) | [ea06eaa] |
+| 2026-10-10 | Accepted | Jens Tirsvad Nielsen | S01 | Added task 6 (embedded scripts to files) and Go/No-Go criterion 5; traceability adds O2 (RC-034) | pending |
 
 ---
 
@@ -23,7 +23,9 @@ workflow.
 ## Deliverable
 
 A documented release process for this repository (validation, version tag,
-changelog), a consumer upgrade guide and a reusable release workflow.
+changelog), a consumer upgrade guide and a reusable release workflow. The
+scoped workflows run scripts that are files in this repository, fetched at a
+reference that a release can pin, instead of Python embedded in their YAML.
 
 ## Go / No-Go Criteria
 
@@ -33,6 +35,7 @@ changelog), a consumer upgrade guide and a reusable release workflow.
 | 2 | Each release has a version tag and a changelog entry that marks breaking changes | Present | Missing |
 | 3 | A consumer pinned to the previous version keeps working after a release | Verified | Breaks |
 | 4 | The publish destination (release page or package registry) is decided and its token scope documented | Decided | Open |
+| 5 | The sync and publish-wiki workflows contain no embedded Python; each runs a script file of this repository, and the tests exercise the files | Count of embedded scripts is 0 and a run in another organization passes | Embedded script remains or a consumer run fails |
 
 ## Dependencies
 
@@ -44,7 +47,7 @@ changelog), a consumer upgrade guide and a reusable release workflow.
 
 | Business Case objective / KPI / user story | Reference |
 | --- | --- |
-| O4 | [BC-001] |
+| O2, O4 | [BC-001] |
 
 ## Ownership
 
@@ -66,6 +69,7 @@ changelog), a consumer upgrade guide and a reusable release workflow.
 | 3 | Write the consumer upgrade guide | Explain how to read a changelog entry, test an update in one repository and roll back. | Yes | Use case candidate: consume a workflow update |
 | 4 | Decide the publish destination | Choose the release or package destination for built artifacts and document the token scope it needs. | No | |
 | 5 | Implement the reusable release workflow | Validate the version, build release notes from the changelog and publish to the chosen destination. | Yes | Use case candidate: publish a release |
+| 6 | Move the embedded scripts of the scoped workflows to files | The sync (`sync-github-metadata.yml`) and publish-wiki workflows embed 200 to 300 lines of Python in their YAML, which is hard to read, lint and review. Move the code to `tools/sync_github_metadata.py` and `tools/publish_wiki.py`; each scoped workflow then checks out `TirSystem/github-action` into its own folder with `actions/checkout` and runs the file, as verified on 2026-10-10 from repositories of two organizations. Keep the behaviour, the messages and the offline tests, which import the files instead of executing the YAML; use `ref: main` first, and let the release process of task 1 define how a consumer pins a tag. | No | |
 
 ---