ci: advance gh-aw compiler pin to v0.84.2 and regenerate lock workflows

[Copilot]

Canonical issue

Canonical issue is linked in PR metadata.

Outcome

Dependabot bumps for github/gh-aw-actions/* are no longer structurally reverted by validate-gh-aw: validation source pins, lock declaration, and compiled lock artifacts now agree on v0.84.2 + setup SHA fd783ac....

Scope

• Included:
  • Pin contract update: /home/runner/work/EventRelay/EventRelay/.github/workflows/gh-aw-validation.yml now asserts gh-aw v0.84.2, stable-release check on tags/v0.84.2, and lock SHA fd783ac87efde5e0c0e05d593f1906ea25b5d92e.
  • Lock declaration update: /home/runner/work/EventRelay/EventRelay/.github/aw/actions-lock.json key/version/SHA moved to github/gh-aw-actions/setup@v0.84.2.
  • Compiler-generated artifacts: recompiled .lock.yml workflows with real gh aw compile:
    • canonical-pr-remediator.lock.yml
    • focused-coverage-controller.lock.yml
    • repo-assist.lock.yml
  • Governance/test/docs alignment:
    • Updated pin expectations in tests/unit/test_gh_aw_workflow_governance.py
    • Updated version references in .github/workflows/README.md and .github/workflows/AUDIT.md
• Explicitly excluded:
  • Dependabot ignore-policy changes (.github/dependabot.yml) and PR-governance policy changes.
  • Any workflow behavior changes unrelated to gh-aw toolchain pinning.

Risk

• Risk level: medium
• Failure mode: partial/hand-edited updates can reintroduce compile diff failures or lock assertion mismatches.
• Rollback: revert this PR commit to restore prior pin/lock state.

Verification

List exact automated and manual checks, tied to the current head SHA.

• Focused tests
  • python -m pytest -o addopts='' tests/unit/test_gh_aw_workflow_governance.py -q
• Required CI
• Review threads resolved

Production evidence

Not applicable — change scope is CI/workflow governance and generated lock artifacts only.

Agent handoff

• One canonical issue is linked
• No competing PR implements the same issue
• Acceptance criteria are satisfied
• Required checks pass on the current head
• Human decision is requested only for product, security, irreversible infrastructure, or production approval

# gh-aw-validation.yml (pin contract)
gh extension install github/gh-aw --pin v0.84.2
if [ "$ACTUAL_VERSION" != "v0.84.2" ]; then exit 1; fi
key = "github/gh-aw-actions/setup@v0.84.2"
sha = "fd783ac87efde5e0c0e05d593f1906ea25b5d92e"

• Fixes ci: gh-aw toolchain pin is hard-coded to v0.82.14 in 4 places, making Dependabot bumps (#1171) structurally unmergeable #1398

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-uvai	Ready	Preview, v0	Sep 8, 2026 11:02pm UTC

[vercel]

Additional Suggestion:

docs/AGENT_CAPABILITIES_CHECKLIST.md line 133 documents an outdated gh-aw pin (v0.82.14) that contradicts the actual workflow, which now pins v0.84.2.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 55a2a0d.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/checkout	3d3c42e5aac5ba805825da76410c181273ba90b1	🟢 7	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 22 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Packaging ⚠️ -1 packaging workflow not detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches
actions/github/gh-aw-actions/setup	fd783ac87efde5e0c0e05d593f1906ea25b5d92e	Unknown	Unknown

Scanned Files

• .github/workflows/repo-assist.lock.yml

[cursor]

Closing as would-regress. main already compiles gh-aw at v0.88.7; this PR pins v0.84.2. Issue #1398 is done on the tree.