[Phase 1] Enumerate & classify every first-party reusable-workflow pin #668

Story

As a release engineer,
I want produce a grounded inventory of every first-party reusable workflow and every site that pins it, classified as compliant or non-compliant,
so that the migration, the cut, and the compliance test all work from one authoritative list instead of guesswork.

Acceptance Criteria

1. A new doc docs/release/reusable-pinning-inventory.md lists every reusable workflow defined in this repo (those with on: workflow_call) and, for each, every caller/stub/template/doc that pins it, with exact file:line and the current uses: ref.
2. Each pin site is classified as compliant (channel/version tag, e.g. @dev-lead/stable) or non-compliant (bare 40-hex SHA, SHA annotated # main/# vN, or @main).
3. The inventory distinguishes same-repo first-party reusables (channel-tag standard; mutable-ref exception per AGENTS.md) from other-repo petry-projects/.github reusables (cross-repo SHA-to-version standard).
4. For each non-compliant same-repo site, the doc names the migration target ref (e.g. @ci-failure-analyst/stable).

Tasks / Subtasks

• Enumerate reusables via on: workflow_call across .github/workflows/ and record each one. (AC: test issue from agent #1)
  • Confirm the four found: ci-failure-analyst-reusable, dev-lead-reusable, pr-review, actions-fleet-monitor
• For each reusable, grep all uses: petry-projects/.github-private/.github/workflows/<name>@... references across .github/workflows/*, templates/*, and docs/**. (AC: test issue from agent #1, Go-live improvements for PR review agent #2)
• Classify every pin and record file:line + current ref + target ref in the inventory table. (AC: Go-live improvements for PR review agent #2, Optimize review: small-PR and incremental fast paths #4)
• Add a section contrasting same-repo (tag) vs other-repo .github (SHA-to-version) pin rules, citing the AGENTS.md exception. (AC: Add @claude delegation, auto-merge, and rebase handling #3)

Dev Notes

• READ-ONLY enumeration — do not modify any workflow, stub, or template in this story; thin-caller stubs are not to be touched here (CLAUDE.md).
• Grounded findings to confirm, not assume: ci-failure-analyst pins 0ef7b6150516c4fa447700b4902e8ed406bcfb99 # main at .github/workflows/ci-failure-analyst.lock.yml:33, templates/ci-failure-analyst.yml:44, and docs/aw/ci-failure-analyst.md:25 (ASCII diagram line).
• Compliant already: dev-lead.yml -> @dev-lead/stable; pr-review-trigger.yml -> @pr-review/stable. actions-fleet-monitor.yml is self-scheduled with no uses: callers.
• Other-repo org reusables pinned SHA-# vN: .github/workflows/feature-ideation.yml (# v2), .github/workflows/agent-shield.yml (# v1) — these belong to petry-projects/.github, not this repo; flag them separately, do not assume they migrate to channel tags.
• The mutable-ref exception is defined in AGENTS.md §"Release channel tags & the mutable-ref exception" (~lines 96-120).

Project Structure Notes

New doc lives under docs/release/ alongside versioning.md and runbook.md. No code changes.

References

• AGENTS.md#release-channel-tags-the-mutable-ref-exception
• docs/release/versioning.md
• docs/aw/ci-failure-analyst.md
• .github/workflows/ci-failure-analyst.lock.yml
• templates/ci-failure-analyst.yml

Likely target surface

• docs/release/reusable-pinning-inventory.md

Story prepared by the BMAD Scrum Master (Bob) for epic #667. Status: ready-for-dev.