Reduce recurring runner-guard static-analysis noise

[Copilot]

The static-analysis report flagged reviewed runner-guard findings that were not being recognized as safe: workflow_run actor allowlist gates for RGS-004, inline runner-guard:ignore suppressions for RGS-012, and step-output interpolation in two workflows.

• Runner-guard authorization gates
  • Treat workflow_run jobs gated by workflow_dispatch plus an explicit actor allowlist as trusted activation gates.
  • Preserve findings unless the gated job is directly or transitively protected through needs.

if: >
  github.event.workflow_run.event == 'workflow_dispatch' &&
  contains(fromJSON('["trusted-user","trusted-bot"]'), github.event.workflow_run.actor.login)

• Inline suppression handling

  • Honor local # runner-guard:ignore <RULE> comments near reported shell findings.
  • Covers generated lock-file line offsets where runner-guard reports the finding on a nearby setup or step-boundary line.

• Workflow interpolation hardening

  • Moved step outputs into environment variables before use in run: blocks for:
    • error-message-lint.yml
    • windows-cli-integration.yml

• Coverage

  • Added focused runner-guard tests for actor allowlist gates, suppression windows, unresolved files, and negative cases.
  • Regenerated required lock files so compiled workflows stay in sync.

• Fixes [static-analysis] Report - 2026-08-17 #53303

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Note

This error may be related to your runner configuration. You can now configure runners for Copilot code review separately from Copilot cloud agent by creating a copilot-code-review.yml file with your setup steps. Read the docs for details.

[gh-aw-bot]

@copilot please take another pass on this PR.

Please address these items, newest first:

• Failed checks: impacted-go-tests, Unit tests (D-L).
• Refresh the branch with the latest base changes if needed.
• Run the pr-finisher skill and summarize the remaining maintainer-visible status.

Run: https://github.com/github/gh-aw/actions/runs/32043948991

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 10.3 AIC · ⌖ 6.79 AIC · ⊞ 8.8K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot please take another pass on this PR.

Please address these items, newest first:...

Addressed in ac9d01543c: merged the latest main, which contains the corrected daily regression audit contract test responsible for both failed jobs. The test now passes with and without CGO; lint, the full Go suite, workflow compilation, and the final change-scoped gate all pass locally. pr-finisher found no unresolved review threads; CI requires a maintainer re-trigger on the updated HEAD.

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.87.1