fix(ci): validate composite action pins against registry

[Ricky Gummadi (Ricky-G)]

Summary

Validate and synchronize composite-action references in .github/actions against .github/ci/actions.toml, preventing the silent drift reported in #3366. Closes #3366.

Supersedes #3367, which was closed without merging.

Problem

The CI generation check only regenerated generated workflows, so pinned actions inside local composite actions could drift from the registry without failing CI.

Changes

File	What changed
.github/actions/ai-agent-runner/action.yml	Sync actions/setup-node with the registry pin.
.github/actions/contributor-check/action.yml	Sync actions/setup-python with the registry pin.
.github/ci/actions.toml	Clarify that the registry covers local composite actions.
.github/workflows/ci-generation-check.yml	Run the guard when .github/actions/** changes.
scripts/ci/generate_workflows.py	Detect drift and unregistered remote action references in --check; synchronize registered pins in --write.
tests/ci/test_generate_workflows.py	Cover drift detection, pin synchronization, and rejection of unregistered references.

Testing

• python scripts/ci/generate_workflows.py --check — passed.
• python -m pytest tests/ci/test_generate_workflows.py -q — 16 passed after the review fix.
• Modified YAML files parsed successfully with yaml.safe_load.
• python -m pytest tests/ci -q — 99 passed, 6 skipped, 4 failed on this Windows host: three tests require /bin/bash, and one existing test expects POSIX path separators.
• Ruff is not installed on the host. The pinned cspell package could not be fetched because package downloads are disabled in this environment; the flagged readlines() call has been replaced with read().splitlines(keepends=True).

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[github-actions]

PR Review Summary

Check	Status	Details
🔍 Code Review	⚠️ Missing	No current-run comment
🛡️ Security Scan	⚠️ Missing	No current-run comment
🔄 Breaking Changes	⚠️ Missing	No current-run comment
📝 Docs Sync	⚠️ Missing	No current-run comment
🧪 Test Coverage	⚠️ Missing	No current-run comment

Verdict: ⚠️ AI review incomplete; ready for human review

AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims.

[MohammadHaroonAbuomar]

• PR body: the design, helper names (_composite_action_files, _registry_by_action_name, check_composite_action_pins, sync_composite_action_pins) and the test fixtures follow #3367 (qubeena07, closed 09-13 for an unaddressed sequencing ask that main has since resolved). Add "Supersedes #3367" to the body and Co-authored-by: qubeena07 <qubeena7@gmail.com> to the commit.

[MohammadHaroonAbuomar]

Approving at 07ae528. The spell-check word is gone (splitlines(keepends=True)), the body names #3367 and the commit credits qubeena07, and the checker still discriminates on all six mutations (stale SHA, changed version comment, unregistered action, --write restore, quoted uses, CRLF round-trip). Both v7.0.0 pins resolve to their tags and every consumer matches the registry byte for byte. CI green.

For the record: the composites run on pull_request_target against the base, so the v7 setup-node and setup-python pins first execute on main after this merges. Watch the first AI PR Review and Contributor Reputation Check runs; if setup-node warns about package-manager-cache, set it to false.