BUILD-8956 Verify config-poetry action

[hedinasr]

Summary

Dogfood PR to validate the new config-poetry action from SonarSource/ci-github-actions#292.

• Adds a Verify config-poetry job that runs the standalone action, then poetry install and poetry build
• Points build-poetry at feat/hnasr/BUILD-8956-createConfigPoetry for end-to-end validation through the refactored build action

Test plan

• Verify config-poetry job passes (standalone action + Poetry install/build via Repox)
• Build job passes (build-poetry consuming config-poetry internally)
• Promote job passes

Revert action refs to @master / @v1 after ci-github-actions#292 is merged.

[hashicorp-vault-sonar-prod]

BUILD-8956

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

This PR updates the CI workflow to dogfood and validate the new config-poetry GitHub Action and to pass the produced build number into the promote job.

Changes:

• Exposes BUILD_NUMBER as an output from the build job (sourced from the config-poetry step).
• Adds mise-action setup and runs the standalone config-poetry action before build-poetry.
• Propagates BUILD_NUMBER into the promote job environment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[gitar-bot]

Code Review ✅ Approved

Integrates the new config-poetry action into the build pipeline and propagates the build number to the promotion job. No issues found.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[julien-carsique-sonarsource]

This PR should not be merged as it is. I added the DO NOT MERGE label and moved the PR to draft.
Of course, there are the temporary dogfooding pins that will be removed before merge.
But also

• build-poetry includes config-poetry, that's the default usage we want to validate with the workflow on master
• config-poetry can be tested as in 09e1bb2, eventually merged on master or not (be careful that poetry install && poetry build may not be correct/accurate is set_project_version() is not in config-poetry. The verify-config-poetry job was ok.
• 085cd83 should be merged on master (except the lines 32, 33)
• fix the runs-on: github-ubuntu-latest-s with the latest recommendations in order to validate on the expected runners