feat: implement issue #1493 — [Phase 2 follow-up] Complete the #1184 legacy→major-scoped pin migration in the reusable-pin compliance check (split from #687 ACs 7–13)

.github/workflows/test-dev-lead.yml

@@ -214,7 +214,9 @@ jobs:
           persist-credentials: false
       - name: Install PyYAML
         run: python3 -m pip install --quiet --only-binary ":all:" pyyaml==6.0.3
-      - name: Reject SHA / off-channel pins on any first-party reusable
+      - name: "Classifier semantics (canonical / DEPRECATED-legacy / violation) — #1493"
+        run: python3 tests/dev-lead/integration/test_reusable_pin_compliance_classifier.py
+      - name: Reject SHA / off-channel pins; inventory legacy → major-scoped migration
         run: python3 tests/dev-lead/integration/test_reusable_pin_compliance.py
 
   agents-paused-preflight:

AGENTS.md

@@ -444,7 +444,14 @@ all of them.** Two kinds of tag exist per reusable:
 
 - **Immutable releases** `<name>/vX.Y.Z` — never moved or deleted; the audit trail and rollback targets.
 - **Moving channel tags** `<name>/v<MAJOR>-<tier>` (major-scoped, #1184; tiers `stable`, and where live
-  `next`/`ring0`/`ring1`) — what callers pin to; advanced on promotion by **moving** the tag.
+  `next`/`ring0`/`ring1`) — the **canonical** form callers pin to; advanced on promotion by **moving** the tag.
+  Examples: `@dev-lead/v1-stable`, `@pr-review/v1-next`, `@ci-failure-analyst/v1-stable`.
+- **Legacy bare-tier channel** `<name>/<tier>` (e.g. `@pr-review/next`) — the pre-#1184 form, **DEPRECATED**.
+  It is still the sanctioned mutable-ref exception (never flagged as an "unpinned action"), but it is being
+  migrated to the major-scoped canonical form. The `reusable-pin-compliance` check
+  (`tests/dev-lead/integration/test_reusable_pin_compliance.py`) reports a bare-tier pin as DEPRECATED with the
+  major-scoped ref it should become; during the migration window this is a **warning, not a failure**
+  (#687 AC #8), so `main` stays green until every legacy pin is repinned.
 
 **Scoped exception to the SHA-pin standard.** The org standard requires SHA-pinning actions to avoid
 mutable-ref supply-chain risk. That rule targets **third-party** actions. The channel tags above are

docs/aw/ci-failure-analyst.md

@@ -22,7 +22,7 @@ The workflow uses the **reusable workflow** (`workflow_call`) pattern — the sa
 ```
 repo-x (check_run: failure)
   └─ .github/workflows/ci-failure-analyst.yml   ← ~20-line stub (no logic)
-      └─ uses: petry-projects/.github-private/.github/workflows/ci-failure-analyst-reusable.yml@ci-failure-analyst/stable
+      └─ uses: petry-projects/.github-private/.github/workflows/ci-failure-analyst-reusable.yml@ci-failure-analyst/v1-stable
           ├─ resolves PR (non-fork only)
           ├─ idempotency check (<!-- ci-analyst sha=... -->)
           ├─ installs Claude Code

templates/ci-failure-analyst.yml

@@ -41,6 +41,6 @@ jobs:
     if: >-
       github.event.check_run.conclusion == 'failure' &&
       !startsWith(github.event.check_run.name, 'CI Failure Analyst')
-    uses: petry-projects/.github-private/.github/workflows/ci-failure-analyst-reusable.yml@ci-failure-analyst/stable  # NOSONAR(githubactions:S7637) first-party channel ref
+    uses: petry-projects/.github-private/.github/workflows/ci-failure-analyst-reusable.yml@ci-failure-analyst/v1-stable  # NOSONAR(githubactions:S7637) first-party channel ref
     secrets:
       CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}