chore: sync public mirror from internal

[haasonsaas]

Summary

• sync the sanitized public tree from evalops/maestro-internal
• keep evalops/maestro as a generated public mirror of the private source of truth
• preserve public-owned CI and trusted-publishing workflows from the public checkout
• internal source SHA: aca5c30647e624115039715317154bc7993f820e
• last generated public sync base: d61a33e392daf6de66e7d0d3560646bd7bb5bfa7
• previewed public-tree drift: 4 file(s) to copy/update and 0 stale file(s) to delete
• public-only commits since last generated sync: 0

Source-of-truth status

Public Mirror Drift Audit

• package: @evalops/maestro
• private source: https://github.com/evalops/maestro-internal@main (aca5c30647e6)
• public projection: https://github.com/evalops/maestro@main (d61a33e392da)
• files to copy or update: 4
• stale files to delete: 0
• result: drift detected
• invariant: public_projection_has_drift

Sample Changed Paths

• copy/update Makefile
• copy/update scripts/prepare-public-release-mirror.mjs
• copy/update test/scripts/cerebro-e2e-config.test.ts
• copy/update test/scripts/prepare-public-release-mirror.test.ts

Guidance

Let internal main generate and merge the public sync PR before relying on public main.

Drift sample

• copy/update Makefile
• copy/update scripts/prepare-public-release-mirror.mjs
• copy/update test/scripts/cerebro-e2e-config.test.ts
• copy/update test/scripts/prepare-public-release-mirror.test.ts

Public-only commits since last generated sync

• none detected since last generated sync

Validation

• generated by the sync-public-release-mirror workflow in public-tree mode

[cursor]

PR Summary

Low Risk
Low risk: changes are limited to Makefile developer workflows and the public-release mirror exclude matcher, with added tests to lock in behavior. Main risk is unintended exclusion/inclusion of files during mirror generation or local Cerebro E2E setup if the new precedence is incorrect.

Overview
Improves the local Cerebro E2E Make targets by capturing the output of scripts/check-cerebro-e2e.mjs --print-env into an env_exports variable before eval, making env threading into nested make invocations more reliable.

Fixes scripts/prepare-public-release-mirror.mjs exclude logic so explicit exclude patterns can override PUBLIC_INCLUDE_OVERRIDES (e.g., allowing .env.example to be excluded when listed). Updates/extends tests to assert the new Makefile plumbing and the corrected mirror exclude precedence.

^{Reviewed by Cursor Bugbot for commit 6f2abb8. Bugbot is set up for automated code reviews on this repo. Configure here.}