Regen stubs workflow fails: decree repo not checked out for protos

[zeevdr]

Description

The Regen stubs workflow (.github/workflows/regen-stubs.yml) has failed on every decree-released dispatch (2026-06-19, 2026-06-21, 2026-06-30). The job checks out only this repository, but make generate bind-mounts ../decree/proto into the proto-generation container. With no sibling checkout of opendecree/decree, Docker creates an empty mount source, so protoc reports Could not make proto path relative: /proto/centralconfig/v1/*.proto: No such file or directory and make generate exits 2.

This is pre-existing and non-urgent: the decree v0.12.0-alpha.5 release changed no protos, so the committed stubs are not stale. The break only matters on the next actual proto change. A companion fix is tracked for the TypeScript SDK.

Acceptance criteria

• The workflow checks out opendecree/decree so make generate finds the protos (for example, check it out into a path the proto mount resolves to, or parametrize the proto directory).
• A workflow_dispatch trigger with a version input is added so the workflow can be tested without cutting a release.
• A manual workflow_dispatch run completes green: stubs regenerate, make test passes, and a pull request is opened (a no-op pull request is acceptable when protos are unchanged).

[zeevdr]

Companion fix for the TypeScript SDK: opendecree/decree-typescript#142 (same root cause — regen-stubs.yml never checks out the decree repo).