The publish job only waited on the build jobs, so a release could reach
PyPI while the `notes` job failed, leaving no GitHub Release. simplint
0.4.0 hit exactly that.

Publish now also waits for the notes job, so a notes failure stops the
upload.

## Changes

- `publish` needs `[tag-build, github-notes]`
- gw `tox-dev/github-workflows` pins in this workflow moved to 6.5.5
(`13381289334b15375958be7f7438f3c3d860e575`).

macOS runners are capped and shared across tox-dev, and 836 macOS jobs
got no runner in 7 days. This PR keeps macOS coverage in proportion to
the macOS-specific code in each repo and moves the rest to a weekly run.

- Superseded pull request runs now cancel. Pushes to `main` run to
completion.
- macOS keeps 3.15 and 3.15t on every event. The other six macOS rows
run on the existing Monday cron (`0 6 * * 1`).
- The daily cron moves from `0 8 * * *` to `17 0 * * *`.

The `exclude` expression drops the extra macOS rows unless the event is
the Monday cron. The macOS `darwin` branches in the lock code
(`renamex_np`, `sysctl`) stay covered on every event.

[ty 0.0.99](https://github.com/astral-sh/ty/releases/tag/0.0.99) broke
the `type` env on main. Inside a function, a variable annotated with a
bare `Final` and assigned the result of a generic call now infers as
`Unknown`. The lock built from `lock_type(...)` in the non-bool
`blocking` test hit this, so the `invalid-argument-type` ignore on the
next line no longer matched anything and `--error-on-warning` failed on
the unused ignore.

The lock is now annotated `Final[BaseFileLock]`. ty sees the real type
again and the ignore suppresses the error it was written for.

A pull request could merge green and still break the next release.
Release preparation assembles under rules no pull request check applied:
[prek](https://github.com/j178/prek) hooks install with packages from
the last seven days held back, fragments link to their pull requests,
and the changelog builds and formats.
[simplint#55](gaborbernat/simplint#55) merged
with every check green, and the [next release
failed](https://github.com/gaborbernat/simplint/actions/runs/42183854370)
while installing its hooks. 🚦

The required gate now runs this repository's own prepare workflow as a
dry run, through the `dry-run` input added in [github-workflows
6.6.0](tox-dev/github-workflows#53). The dry run
uses the same inputs and the same assembly as a real release and skips
the push job. A pull request that would break the release now fails its
gate instead. The dry run needs no App key, and it has its own
concurrency group, so it never queues behind a real release.

Releases dispatched by hand behave as before.

A pull request could merge green and still break the scheduled
maintenance pull requests. pre-commit.ci builds hook environments from
the newest releases, while the maintenance jobs build them with packages
from the last seven days held back, so a hook bumped to a younger
release, or one that rewrites files when built fresh, only fails there.
🧹

The required gate now runs every hook over the whole tree under that
cutoff, through the shared `cooled-hooks` workflow added in
[github-workflows
6.7.0](tox-dev/github-workflows#57), so the pull
request fails instead. Release preparation moves to the same 6.7.0 pin.

The cooled hook run applied the seven-day cutoff to the hooks
themselves, so a hook that calls `uv run` re-resolved its project under
the cutoff and failed. [github-workflows
6.7.1](tox-dev/github-workflows#58) builds hook
environments under the cutoff and runs the hooks with the normal
environment; this moves the shared workflow pins to it. 🧹

A pull request that bumps a pre-commit hook to a release younger than
seven days failed the `Hooks under the cooldown` check, although the
bump is deliberate. [github-workflows
6.7.2](tox-dev/github-workflows#59) admits each
exact hook pin up to its upload time while the release is inside the
cooldown window; dependencies, ranges and newer releases stay cooled.
This moves the shared workflow pins to it. 🧹

The shared changelog check now requires a `# expires YYYY-MM-DD` comment
directly above each Nab cutoff exception, so the existing exception gets
one.

[U-Boot's buildman process-limit
test](https://github.com/u-boot/u-boot/blob/main/tools/buildman/test.py#L834)
can leave a contended filelock retrying at its timeout boundary when the
test's virtual clock stops advancing
([#920](#920)). A caller
waiting for that lock now receives `Timeout` at the deadline.

The shared acquisition path decides when a wait has expired for both
Unix and soft locks. It still attempts to acquire a lock before checking
the deadline, so an available lock can be acquired with a zero timeout.

Each wheel now carries a [PEP 770](https://peps.python.org/pep-0770/)
SBOM, a CycloneDX document in `.dist-info/sboms/` that lists what the
wheel holds and the tools that built it, so scanners and auditors can
read its contents without unpacking or guessing. 📦

[python-sbom](https://github.com/tox-dev/python-sbom), a hatchling build
hook, writes the SBOM after hatchling writes the wheel.
`[tool.python-sbom]` names tox-dev as the supplier. The release build
installs the build requirements from the lock with hashes, so the hook
and its dependencies join the `build` group. python-sbom 0.1.2 is
younger than the seven-day cooldown, so `[tool.nab]` carries an
exception that expires on 2026-11-15.