[CI] Add manual Windows container publisher

[jrhemstad]

Description

Related: rapidsai/devcontainers#760

Adds an on-demand workflow that builds, tests, and publishes the full Windows
devcontainer matrix to the internal
ghcr.io/nvidia/cccl-windows-containers package.

The workflow:

• can only be started manually;
• verifies that the destination package is internal before building;
• serializes publisher runs without cancelling an in-progress release;
• hard-codes the destination package;
• grants packages: write only to the reusable publishing job; and
• passes no CCCL repository or organization secrets.

The reusable workflow is pinned to the exact tested head of devcontainers #760.
Keep this PR in draft until that dependency merges, then update the pin if its
merge strategy produces a different commit.

Before the first dispatch, the package settings must grant NVIDIA/cccl Write
under Manage Actions access.

Validation

• pre-commit run --files .github/workflows/publish-windows-containers.yml
• actionlint .github/workflows/publish-windows-containers.yml
• GitHub workflow JSON Schema validation
• Cross-repository E2E: https://github.com/NVIDIA/cccl/actions/runs/33660598173
• Internal package: https://github.com/orgs/NVIDIA/packages/container/package/cccl-windows-containers

Checklist

• New or existing tests cover these changes.
• The documentation is up to date with these changes.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 574e5b02-5b87-43b3-937c-dde343c6eb0b

📥 Commits

Reviewing files that changed from the base of the PR and between 8f674c0 and 1298e8e.

📒 Files selected for processing (1)

• .github/workflows/publish-windows-containers.yml

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

📝 Summary

Summary by CodeRabbit

• New Features
  • Added a manually triggered workflow to verify the Windows container package and build and publish the Windows container image.
  • Added safeguards for controlled execution, including limited permissions, serialized runs, strict error handling, and a preflight timeout.

Walkthrough

Changes

The pull request adds a manually triggered workflow that validates the internal package and then publishes the Windows container image through a pinned reusable workflow.

Windows container publishing

Layer / File(s)	Summary
Workflow controls .github/workflows/publish-windows-containers.yml	The workflow adds manual dispatch, strict Bash defaults, empty top-level permissions, and serialized execution.
Package visibility preflight .github/workflows/publish-windows-containers.yml	The preflight job checks GitHub package visibility and fails unless cccl-windows-containers is internal.
Container image publishing .github/workflows/publish-windows-containers.yml	The publish job requires successful preflight, grants scoped permissions, and invokes the pinned reusable Windows release workflow for ghcr.io/nvidia/cccl-windows-containers.

Merge Risk: ⚪ Minimal · up to 1298e

This adds a manually triggered, narrowly scoped Windows container publishing workflow with no actionable merge-blocking risk remaining after normal checks and review.

---

_{Comment @coderabbitai help to get the list of available commands.}