ci(gh-aw): add CI guard for lock-file drift and compiler-version skew

[TheLarkInn]

Summary

Adds an aw-lock-drift job to ci.yml that closes the honour-system gap described in #1390: CI now verifies that every .github/workflows/*.lock.yml is in sync with its .md source and that all locks were compiled with the same, pinned gh-aw version.

The job:

1. Installs a pinned gh-aw version — the new top-level GH_AW_VERSION: v0.86.2 env var in ci.yml is the single canonical pin (referenced from CLAUDE.md), so CI does not float to latest
2. Runs gh aw compile
3. Fails if git diff --exit-code shows any change under .github/workflows / .github/aw (lock drift, including actions-lock.json)
4. Fails if gh aw compile emits untracked files (catches the orphaned-source class of bug; porcelain output filtered to ?? entries so modified tracked files can never be misreported)
5. Asserts every lock reports the same compiler_version and that it equals the pinned GH_AW_VERSION

CLAUDE.md now names GH_AW_VERSION as the canonical pin location and documents the CI enforcement.

Acceptance criteria from #1390

• CI fails on a PR that edits a workflow .md without committing the regenerated .lock.yml
• CI fails if gh aw compile produces untracked files
• The gh-aw version is pinned and documented, and CI does not float to latest
• Verified by deliberately introducing drift and observing the failure — in a clean core.autocrlf=false clone (matching CI runners):
  • Clean tree after gh aw compile → check passes, exit 0 (committed locks are byte-identical to a fresh compile under v0.86.2, confirmed with git diff --ignore-cr-at-eol)
  • Modified .lock.yml content → ::error::Lock files are out of date..., exit 1
  • Stray untracked file under .github/workflows → ::error::'gh aw compile' produced untracked files..., exit 1
  • One lock hand-set to v0.85.4 → mixed-version error listing both versions, exit 1
  • GH_AW_VERSION bumped past the locks → pin-mismatch error, exit 1

The aw-lock-drift job passing on this PR's own run demonstrates the clean-tree case on a real runner.

Notes

• This PR changes no lock files — the committed locks are already in sync with their sources under the pinned v0.86.2.
• The pin lives in a workflow env var rather than an action ref because GitHub Actions does not evaluate expressions in uses:; gh extension install github/gh-aw --pin "$GH_AW_VERSION" keeps one obvious place to bump.
• Companion PRs ci(gh-aw): add CI guard for lock-file drift and compiler-version skew #1529, ci(gh-aw): guard against lock-file drift and compiler-version skew #1558, ci(gh-aw): add lock-drift guard with pinned gh-aw version #1570, ci(gh-aw): add lock-drift guard with pinned gh-aw version #1580, ci(gh-aw): add lock-file drift and compiler-version guard #1583 implement the same guard; this version adds the ??-filtered untracked check, the uniform-compiler_version + pin-equality assertions, and a gh aw version echo in the install step for easier CI debugging.

Closes #1390

Co-authored-by: Copilot App 223556219+Copilot@users.noreply.github.com

[Copilot]

Pull request overview

Adds a CI enforcement mechanism to ensure agentic workflow lock files remain reproducible and consistent across the repository, closing the “honour-system” gap described in #1390.

Changes:

• Pin gh-aw via a top-level GH_AW_VERSION in ci.yml and document it as the canonical source of truth.
• Add an aw-lock-drift CI job that recompiles workflows and fails on lock drift, untracked generated files, or compiler-version skew.
• Update CLAUDE.md to describe the pin location and the new CI enforcement.

Show a summary per file

File	Description
CLAUDE.md	Updates documentation to point to ci.yml as the canonical gh-aw version pin and describes the new enforcement job.
.github/workflows/ci.yml	Adds GH_AW_VERSION pin and introduces aw-lock-drift job to detect drift/untracked output/version skew after gh aw compile.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Lite

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.57%. Comparing base (6d3368d) to head (e0a0da0).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1585   +/-   ##
=======================================
  Coverage   97.57%   97.57%           
=======================================
  Files         127      127           
  Lines       39102    39102           
  Branches      974      974           
=======================================
  Hits        38154    38154           
  Misses        853      853           
  Partials       95       95           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.