ci(gh-aw): add CI guard for lock-file drift and compiler-version skew

[TheLarkInn]

Closes #1390

What

Adds an aw-lock-drift job to ci.yml so stale gh-aw lock files fail CI instead of relying on the honour system:

1. Pinned compiler — new workflow-level GH_AW_VERSION: v0.86.2 env var is the single canonical pin (no floating to latest). The install step removes any preinstalled gh-aw copy first so the pin always wins (gh extension install fails when the extension already exists).
2. Recompiles all workflows with the pinned version.
3. Fails on drift — git diff --exit-code -- .github/workflows .github/aw catches locks not regenerated from their .md sources.
4. Fails on untracked output — git ls-files --others --exclude-standard catches the orphaned-source class of bug.
5. Asserts version uniformity — every *.lock.yml must report exactly one compiler_version, and it must equal GH_AW_VERSION.

CLAUDE.md now names GH_AW_VERSION as the canonical pin and documents the enforcement job.

Acceptance criteria

• CI fails on a PR that edits a workflow .md without committing the regenerated .lock.yml (drift check)
• CI fails if gh aw compile produces untracked files (untracked-output check)
• gh-aw version pinned and documented; CI does not float to latest
• Verified locally on a scratch worktree: tampered lock → drift failure; planted orphan .lock.yml → untracked failure; mixed compiler_version headers → skew failure; uniform wrong version → pin-mismatch failure. A clean gh aw compile at the pinned version produces zero drift on current main.

Co-authored-by: Copilot App 223556219+Copilot@users.noreply.github.com

[Copilot]

Pull request overview

Adds a CI enforcement guard to ensure GitHub Agentic Workflows (gh-aw) generated lock files stay in sync with their .md sources and that all locks are compiled with a single, pinned gh-aw compiler version.

Changes:

• Introduces a new aw-lock-drift job in CI that installs a pinned gh-aw version, recompiles workflows, and fails on drift, untracked outputs, or compiler-version skew.
• Centralizes the gh-aw compiler pin as GH_AW_VERSION in .github/workflows/ci.yml.
• Updates CLAUDE.md to document the canonical pin location and the CI enforcement behavior.

Show a summary per file

File	Description
CLAUDE.md	Documents GH_AW_VERSION as the canonical gh-aw pin and describes the new enforcement job.
.github/workflows/ci.yml	Adds GH_AW_VERSION and the aw-lock-drift job to detect lock drift, untracked outputs, and compiler skew.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Lite

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.57%. Comparing base (6d3368d) to head (5f4b741).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1619   +/-   ##
=======================================
  Coverage   97.57%   97.57%           
=======================================
  Files         127      127           
  Lines       39102    39102           
  Branches      974      974           
=======================================
  Hits        38154    38154           
  Misses        853      853           
  Partials       95       95           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.