diff --git a/.github/workflows/visual-regression-checker.lock.yml b/.github/workflows/visual-regression-checker.lock.yml
index 6f01b0842dd..104e29988fb 100644
--- a/.github/workflows/visual-regression-checker.lock.yml
+++ b/.github/workflows/visual-regression-checker.lock.yml
@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"29b6da6da614beae63bc72917813dab39a0203de9576460fe168c2a9c67018d8","body_hash":"c06ffaa0dd77f6147f6a4c27aacf37d8b48a63face007301645c1bfde07efc33","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.78"}}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"c3c781893a4a8b37efa3212ca8c85f4d176ba2c2e31358fef434cbeea4f7e01a","body_hash":"c06ffaa0dd77f6147f6a4c27aacf37d8b48a63face007301645c1bfde07efc33","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.78"}}
 # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.44","digest":"sha256:0d727725c737b58c7bdf51f640cffb928385ec46517e0917c7f1a02f1bada8b4","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.44@sha256:0d727725c737b58c7bdf51f640cffb928385ec46517e0917c7f1a02f1bada8b4"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44","digest":"sha256:b50fbadba138f6e9aba94aca09711335c489bb3b15861220cb66f6092e042dc7","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44@sha256:b50fbadba138f6e9aba94aca09711335c489bb3b15861220cb66f6092e042dc7"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.44","digest":"sha256:83e48bbe12c634be8c228a576832fe45f66c529ac3659db92bddbcf2eeb6d627","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.44@sha256:83e48bbe12c634be8c228a576832fe45f66c529ac3659db92bddbcf2eeb6d627"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.9","digest":"sha256:e5a1569aeaf41820fa7bdee3e94468cae448133cdbf00119ad24f5b74db1ab9f","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.9@sha256:e5a1569aeaf41820fa7bdee3e94468cae448133cdbf00119ad24f5b74db1ab9f"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:0d9f1fb5fd6610c0ac1f5194a38e45a8a1e81f8a390d5142d8e4e6f26a4b3196","pinned_image":"ghcr.io/github/gh-aw-node@sha256:0d9f1fb5fd6610c0ac1f5194a38e45a8a1e81f8a390d5142d8e4e6f26a4b3196"},{"image":"ghcr.io/github/github-mcp-server:v1.9.0","digest":"sha256:881b53d6f75f69bdbc1b5b10fc2f1361717c19054143b3a8529fb5c32061a50e","pinned_image":"ghcr.io/github/github-mcp-server:v1.9.0@sha256:881b53d6f75f69bdbc1b5b10fc2f1361717c19054143b3a8529fb5c32061a50e"}],"has_pull_request":true}
 # This file was automatically generated by gh-aw. DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
@@ -491,36 +491,7 @@ jobs:
         run: "nohup npm run dev -- --host 0.0.0.0 --port 4321 > /tmp/gh-aw/agent/preview.log 2>&1 &\nPID=$!\necho \"$PID\" > /tmp/gh-aw/agent/server.pid\necho \"Server PID: $PID\"\n"
         working-directory: ./docs
       - name: Wait for server readiness
-        run: |-
-          MAX_WAIT=90
-          WAITED=0
-          until (echo > /dev/tcp/127.0.0.1/4321) > /dev/null 2>&1; do
-            if [ -f /tmp/gh-aw/agent/server.pid ] && ! kill -0 "$(cat /tmp/gh-aw/agent/server.pid)" 2>/dev/null; then
-              echo "Docs server process exited before opening port 4321" >&2
-              cat /tmp/gh-aw/agent/preview.log >&2
-              exit 1
-            fi
-            WAITED=$((WAITED + 3))
-            if [ $WAITED -ge $MAX_WAIT ]; then
-              echo "Docs server port 4321 did not open in ${MAX_WAIT}s" >&2
-              cat /tmp/gh-aw/agent/preview.log >&2
-              exit 1
-            fi
-            echo "Waiting for docs port... ($WAITED/${MAX_WAIT}s)"
-            sleep 3
-          done
-          WAITED=0
-          until curl -sf http://localhost:4321/gh-aw/ > /dev/null 2>&1; do
-            WAITED=$((WAITED + 3))
-            if [ $WAITED -ge $MAX_WAIT ]; then
-              echo "Dev server did not become ready in ${MAX_WAIT}s" >&2
-              cat /tmp/gh-aw/agent/preview.log >&2
-              exit 1
-            fi
-            echo "Waiting for dev server response... ($WAITED/${MAX_WAIT}s)"
-            sleep 3
-          done
-          echo "Dev server is ready"
+        run: "MAX_WAIT=90\nWAITED=0\n# runner-guard:ignore RGS-012 -- loopback-only port probe for the docs server started in this job; no external network or secret data is involved.\nuntil (echo > /dev/tcp/127.0.0.1/4321) > /dev/null 2>&1; do\n  if [ -f /tmp/gh-aw/agent/server.pid ] && ! kill -0 \"$(cat /tmp/gh-aw/agent/server.pid)\" 2>/dev/null; then\n    echo \"Docs server process exited before opening port 4321\" >&2\n    cat /tmp/gh-aw/agent/preview.log >&2\n    exit 1\n  fi\n  WAITED=$((WAITED + 3))\n  if [ $WAITED -ge $MAX_WAIT ]; then\n    echo \"Docs server port 4321 did not open in ${MAX_WAIT}s\" >&2\n    cat /tmp/gh-aw/agent/preview.log >&2\n    exit 1\n  fi\n  echo \"Waiting for docs port... ($WAITED/${MAX_WAIT}s)\"\n  sleep 3\ndone\nWAITED=0\n# runner-guard:ignore RGS-012 -- localhost readiness request to the docs server started above; response is discarded and no secrets are sent.\nuntil curl -sf http://localhost:4321/gh-aw/ > /dev/null 2>&1; do\n  WAITED=$((WAITED + 3))\n  if [ $WAITED -ge $MAX_WAIT ]; then\n    echo \"Dev server did not become ready in ${MAX_WAIT}s\" >&2\n    cat /tmp/gh-aw/agent/preview.log >&2\n    exit 1\n  fi\n  echo \"Waiting for dev server response... ($WAITED/${MAX_WAIT}s)\"\n  sleep 3\ndone\necho \"Dev server is ready\""
 
       - name: Configure Git credentials
         env:
diff --git a/.github/workflows/visual-regression-checker.md b/.github/workflows/visual-regression-checker.md
index 6ecc570fb3e..ffa27d6e879 100644
--- a/.github/workflows/visual-regression-checker.md
+++ b/.github/workflows/visual-regression-checker.md
@@ -72,6 +72,7 @@ steps:
     run: |
       MAX_WAIT=90
       WAITED=0
+      # runner-guard:ignore RGS-012 -- loopback-only port probe for the docs server started in this job; no external network or secret data is involved.
       until (echo > /dev/tcp/127.0.0.1/4321) > /dev/null 2>&1; do
         if [ -f /tmp/gh-aw/agent/server.pid ] && ! kill -0 "$(cat /tmp/gh-aw/agent/server.pid)" 2>/dev/null; then
           echo "Docs server process exited before opening port 4321" >&2
@@ -88,6 +89,7 @@ steps:
         sleep 3
       done
       WAITED=0
+      # runner-guard:ignore RGS-012 -- localhost readiness request to the docs server started above; response is discarded and no secrets are sent.
       until curl -sf http://localhost:4321/gh-aw/ > /dev/null 2>&1; do
         WAITED=$((WAITED + 3))
         if [ $WAITED -ge $MAX_WAIT ]; then