Upgrade workflows with latest gh-aw pre-release

[lpcox]

Summary

• Ran gh aw upgrade --pre-releases with gh-aw v0.89.17
• Recompiled all 36 agentic workflows
• Updated pinned workflow actions:
  • astral-sh/setup-uv from v10.1.0 to v10.2.0
  • ruby/setup-ruby from v1.324.0 to v1.325.0
• Workflow compilation was deterministic, so generated lock files did not require changes

Validation

• make agent-finished ✅
• 669 Rust guard tests passed
• All Go build, lint, and test checks passed

[Copilot]

Copilot review overview

🟢 Approval recommended

The updated versions and SHAs are valid and the lock file remains consistent.

Review effort: Balanced
Findings: None

What changed in this PR

Updates the gh-aw action lock catalog after recompiling workflows with v0.89.17.

Changes:

• Upgrades astral-sh/setup-uv to v10.2.0.
• Upgrades ruby/setup-ruby to v1.325.0.
• Pins both actions to their verified release SHAs.

File	Description
.github/​aw/​actions-lock.json	Updates two action versions and commit pins.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

🔒 mcpg Read-Only Stress — default AWF

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues, list_pull_requests, get_file_contents, list_commits)	data (200)	ALLOWED	✅
B	MCP	writes (add_issue_comment/star_repository/issue_write/create_branch/create_or_update_file/create_pull_request)	all 6 tools absent from 23-tool catalog	BLOCKED	⚠️
C	CLI	reads (same as A via github CLI)	data (200)	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment)	gh unauthenticated (no GH_TOKEN)	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated (no GH_TOKEN)	BLOCKED	⚠️

Overall: INCONCLUSIVE

Notes:

• Part A/C reads all succeeded (status=200) with real data returned.
• Part B: none of the 6 targeted write tools appear in the gateway's exposed catalog (only 23 read-only tools: get_commit, get_file_contents, get_label, get_latest_release, get_release_by_tag, get_tag, issue_read, list_branches, list_commits, list_issue_fields, list_issue_types, list_issues, list_pull_requests, list_releases, list_repository_collaborators, list_starred_repositories, list_tags, pull_request_read, search_code, search_commits, search_issues, search_pull_requests, search_repositories). Per methodology, absence from the catalog only proves backend/toolset config (gh-aw's GITHUB_READ_ONLY=1), not the gateway's independent DIFC/guard layer — recorded INCONCLUSIVE, not PASS.
• Part D/E: gh CLI is unauthenticated in this environment (no GH_TOKEN), so REST/GraphQL write-blocking via GitHub API token scope could not be exercised this run.
• No writes leaked: zero reactions, stars, issues, comments, branches, files, or PRs were created.

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime