feat(workflows): backfill per-solution deploy workflows for the 12 uncovered data-plane surfaces (ADR 0051)

[marcusjacobson]

Summary

Tracking issue. ADR 0051 rules that the per-solution workflow (deploy-<solution>.yml) is the unit of data-plane apply, and retires the monolithic deploy-data-plane.yml. Of the monolith's ~14 surfaces, only 5 have a per-solution workflow today. The other 12 have no automated apply path at all.

This issue tracks backfilling those 12. It is the issue the operator docs link to when they state, plainly, that a surface has no automated apply path yet and that the interim path is the local scripts/Deploy-*.ps1 reconciler.

Nothing is being lost here, and that is the point. These 12 surfaces never had a working apply path — they had a step inside a workflow that has never once executed (90 runs, 0 successes, 0 jobs scheduled, invalid since the scaffold commit). Retiring the monolith does not remove an apply path; it removes the false appearance of one. This issue tracks building the real thing.

Covered today (5 — no action)

Workflow	Surface
deploy-labels.yml	Sensitivity labels
deploy-label-policies.yml	Label policies
deploy-auto-label-policies.yml	Auto-labeling policies
deploy-dlp.yml	DLP policies
deploy-irm.yml	IRM policies

To backfill (12)

Each row is its own item, filed via @idea-intake, built one at a time. This issue is the umbrella; it is not itself an implementation item.

• deploy-administrative-units.yml — administrative units
• deploy-role-groups.yml — Purview role groups (scripts/Deploy-PurviewRoleGroups.ps1)
• deploy-audit-retention.yml — audit retention policies
• deploy-retention.yml — retention / data lifecycle management
• deploy-records.yml — records management / file plan
• deploy-irm-entity-lists.yml — IRM entity lists
• deploy-collections.yml — Data Map collections
• deploy-glossary.yml — glossary
• deploy-classifications.yml — custom classifications
• deploy-data-sources.yml — data sources
• deploy-scans.yml — scans
• deploy-unified-catalog.yml — unified catalog

Acceptance criteria (per backfilled workflow)

Each must conform to the ADR 0051 §Decision contract:

• One workflow, one surface — owns exactly one Deploy-*.ps1 reconciler; applies no surface it does not name.
• push: path trigger — auto-applies on merge, bound to the data-plane/** path and the reconciler it owns.
• Small workflow_dispatch input surface — the repo's self-imposed working ceiling is <= 10 inputs, deliberately far below GitHub's documented 25-property cap. (The existing five land at 2-4.)
• permissions: {} deny-by-default, with least-privilege scopes granted per job, not once at the top of the file.
• A concurrency: group, so two applies of the same surface cannot interleave.
• Two-pass deterministic skip enumeration and an automated drift-back PR where the surface supports export.
• The surface's docs/solutions/** guide is updated: the "no automated apply path yet" language is removed and replaced by a pointer to the new workflow.
• This tracking issue's checkbox is ticked.

Out of scope

• Deleting deploy-data-plane.yml and the operator-doc sweep — that is the ADR-gated item that links here, tracked separately.
• A deploy-all.yml orchestrator. ADR 0051 explicitly defers this: if ever wanted it is new greenfield workflow_call work, not a rehabilitation of the monolith.
• Doing all 12 in one PR. One surface per item, one item at a time, per the repo's delivery discipline.
• surface-watch.yml (invalid YAML) and drift-detection.yml (failing weekly) — separate items.

Squad Personas

Primary: Automation Engineer (squad:automation-engineer)
Supporting: Lead / Architect (squad:lead-architect), Scribe (squad:scribe)

Notes

• Gate results: cross-cutting. docs/project-plan.md §5 Progress checklist has no matching row, so the §6 dependency-matrix and §8 ADR gates do not apply. The governing ADR (0051) is merged and Accepted (1f63f15, PR docs(adr): add ADR 0051 — per-solution workflow is the unit of data-plane apply #79), so the ADR gate is satisfied.
• Sequencing: this backfill does not block the retirement item. The docs are honest about the gap in the meantime — that honesty is the deliberate interim state ADR 0051 accepts with eyes open.
• Prioritization suggestion: the surfaces whose reconcilers are most exercised in the lab (role-groups, audit-retention, retention/DLM) are the natural first three; unified-catalog is the most likely to churn given ADR 0047 is still in flight.

References

[marcusjacobson]

Linked: the retirement item that these docs' "no automated apply path yet" notices will point at is #81 — fix(workflows): retire the monolithic deploy-data-plane.yml and repoint every operator-facing reference. That item links here (#80) from each of the 12 uncovered surfaces; this issue is the umbrella that tracks closing the gap.