[Phase 3] Generalized compliance test enforcing tag pins for first-party reusables

[github-actions]

Story

As a maintainer,
I want add a CI test that fails when any caller pins a first-party same-repo reusable by SHA or @main instead of a channel/version tag,
so that tag-pinning is an org-enforced standard that blocks regressions for every reusable, not a per-workflow bespoke check.

Acceptance Criteria

1. A new test tests/dev-lead/integration/test_reusable_pinning.py discovers every uses: in .github/workflows/* and templates/* that references a same-repo petry-projects/.github-private/.github/workflows/<name> reusable and FAILS if any pins by a 40-hex SHA or @main (or SHA annotated # main) rather than a channel/version tag.
2. Run against the repinned tree the test PASSES; run against a pre-repin off-main SHA pin it FAILS (regression-proven, e.g. via a fixture or an inline negative case).
3. It does not flag the documented @<name>/stable channel tags, and it excludes other-repo petry-projects/.github reusables (or applies the SHA-to-version rule to them) per the inventory's same-repo/other-repo distinction.
4. The test runs in CI as its own job in .github/workflows/test-dev-lead.yml, mirroring the auto-rebase-stub / dependency-audit-stub jobs.

Tasks / Subtasks

• Author the Python test parsing each workflow/template with PyYAML and collecting jobs.*.uses (and top-level uses for stubs). (AC: test issue from agent #1)
• Implement the same-repo classifier and the SHA/@main rejection, allowing channel/version tags. (AC: test issue from agent #1, Add @claude delegation, auto-merge, and rebase handling #3)
• Add a negative assertion (fixture or literal) proving an off-main SHA pin fails. (AC: Go-live improvements for PR review agent #2)
• Wire a new job into test-dev-lead.yml (checkout + pip install pyyaml + run), modeled on the existing stub jobs. (AC: Optimize review: small-PR and incremental fast paths #4)

Dev Notes

• Model on tests/dev-lead/integration/test_auto_rebase_stub.py and test_dependency_audit_stub.py: PyYAML, iterate jobs.values(), match the reusable substring, regex @[0-9a-f]{40} for SHA detection.
• Wire-in pattern: copy a job block from .github/workflows/test-dev-lead.yml (the dependency-audit-stub/auto-rebase-stub jobs at ~lines 130-152: actions/checkout, pip install --quiet pyyaml, python3 tests/...).
• Test-design (Murat) guidance: assert BOTH directions — positive (a channel-tag ref passes) and negative (a SHA / # main ref fails) — and keep it hermetic (no network, parse refs literally).
• Scope carefully to same-repo reusables (petry-projects/.github-private/...); other-repo org reusables (petry-projects/.github/...) follow the SHA-to-version rule — see open_questions on whether to assert that too.
• This test should land after the repin (story id 6) so the tree is green on merge.

Project Structure Notes

New test under tests/dev-lead/integration/; one new job in .github/workflows/test-dev-lead.yml. Follows the existing stub-test convention.

References

• tests/dev-lead/integration/test_auto_rebase_stub.py
• tests/dev-lead/integration/test_dependency_audit_stub.py
• .github/workflows/test-dev-lead.yml#L130-L152
• docs/release/reusable-pinning-inventory.md

Likely target surface

• tests/dev-lead/integration/test_reusable_pinning.py
• .github/workflows/test-dev-lead.yml

Story prepared by the BMAD Scrum Master (Bob) for epic #667. Status: ready-for-dev.