MIP-0076: notify-umbrella sends submodule-updated on every push

[brunogbv]

Every caller sets permissions: {}, so this keeps permissions: {} and reads the compare API with github.token instead of checking the repo out. event-type stays declared (deprecated, ignored), so a caller still passing it doesn't fail input validation.

The scratch-repo live test (human, not done here) — updated for the fix

The brief's test case — "a code-only push sends only submodule-updated, a docs push sends both,
a first push sends both" — needs a real GitHub push/Actions run, which this task may not do.
Steps for whoever runs it (the PAT scope needed changed: no checkout happens now, so the caller's
own repo needs no Contents grant beyond its default — only the scratch umbrella needs a PAT):

1. Create two throwaway public repos under your own account (or an org you control), e.g.
   scratch-notify-caller and scratch-notify-umbrella.
2. On scratch-notify-umbrella: Settings → Developer settings → fine-grained PAT scoped to just
   that repo, Contents: read & write. Add it as a repo secret on scratch-notify-caller, e.g.
   SCRATCH_PAT. (A scratch umbrella, not marola-dev/marola, so the test can't dispatch into the
   real umbrella.)
3. On scratch-notify-caller, add .github/workflows/notify-umbrella.yml:

   name: notify umbrella
   on:
     push:
       branches: [main]
   jobs:
     notify:
       uses: marola-dev/marola-devkit/.github/workflows/notify-umbrella.yml@mip-0076/3-notify-every-push
       with:
         umbrella: <your-account>/scratch-notify-umbrella
       secrets:
         token: ${{ secrets.SCRATCH_PAT }}

   (A reusable-workflow uses: ref accepts a branch name, not only a tag, so this can point at
   the unreleased branch directly — no devkit release needed to test it. permissions: {} at the
   top, matching today's five real callers, is fine to add too — it's exactly the case this fix
   round makes work.)
4. First push (repo creation, pushing the file above as the initial commit on main):
   github.event.before is the all-zero SHA. Expect the run's log to show both
   dispatched submodule-updated for … and dispatched submodule-docs-updated for …, and the
   docs step's output to be changed=true.
5. Code-only push: commit a change to an unrelated file (e.g. touch a src/placeholder.txt).
   Expect only dispatched submodule-updated …, no submodule-docs-updated line, docs step
   output changed=false.
6. Docs push: commit a change to README.md (or add a file under docs/). Expect both
   dispatch lines again, docs step output changed=true.
7. Paste the three run URLs into the PR, as the plan row asks.
8. Clean up: delete both scratch repos and the PAT afterward.

I did not create any repo or push anything — this is left as the human-run step the brief calls
out.

[brunogbv]

Live test in a throwaway caller, marola-dev/scratch-notify. It has permissions: {} at the top, still passes the deprecated event-type, and uses MAROLA_CROSS_REPO_PAT, dispatching into marola-dev/marola:

Push	Expected	Run	Dispatched
code only (the workflow file)	submodule-updated	37276214158 (re-run after the secret was added)	submodule-updated
README.md change	both	37284350548	submodule-updated, submodule-docs-updated
first push of a new branch (before all zeros)	both	37284393624	submodule-updated, submodule-docs-updated

This also confirms that a no-permission github.token can read the public compare API, and that a caller still passing event-type passes input validation.