[dormouse-bot]

Regenerates the Tend workflows from 0.3.16 to 0.3.17 (compare). It also removes the actions: write exception that #1370 added to the workflow lint and to S63, because the regenerated CI failure reporter no longer holds that permission.

What consumers will notice

• CI failure reports reach triage through an ordinary issue event (Route CI reports through durable ordinary issue triage max-sixty/tend#1580). tend-ci-failures's report job no longer dispatches tend-triage.yaml with its own GITHUB_TOKEN. It now writes as the bot with TEND_BOT_TOKEN, so opening a report fires issues: opened and triage picks it up like any new issue. The job moves into the tend environment, drops to permissions: {}, and still runs only setup-uv and the inline report script. Later failures on the same lane add a comment and start no new session.
• Triage runs in one queued lane (Simplify issue recovery around the daily open-work sweep max-sixty/tend#1581). tend-triage now also fires on issues: reopened. Every triage run shares the tend-triage concurrency group with queue: max, replacing the separate per-issue and per-report groups. The report dispatch input is gone. Stalled reports and causes are left to the daily review-runs sweep instead of a notification re-dispatch.
• Preflight and CI triage make fewer GitHub reads (Reduce GitHub reads in preflight and CI triage max-sixty/tend#1578).
• Every agent workflow now pins max-sixty/tend/claude@0.3.17.

Repository-side changes in this PR

The regenerated report job reads TEND_BOT_TOKEN, which the old exception's lint forbade (tend-ci-failures.yaml `report` reads `TEND_BOT_TOKEN` ). With actions: write gone, the exception has nothing left to bound. scripts/workflow-lint.mjs and scripts/workflow-lint.test.mjs therefore return byte-for-byte to their pre-#1370 contents, and S63 in docs/specs/security-ci.md goes back to the plain agent-managed allowlist, with its word budget ratcheted back to 3400. The job now reads the bot token the way every other tend-*.yaml job does: from the tend environment, which admits only main and is bound by "Automated Maintainer (tend)".

Locally, workflow-lint passes (19 workflows), its test passes 46/46, and spec-lint passes.

[cloudflare-workers-and-pages]

Deploying mouseterm with    Cloudflare Pages

Latest commit:	7f4b0b1
Status:	✅  Deploy successful!
Preview URL:	https://1d262371.mouseterm.pages.dev
Branch Preview URL:	https://tend-update-workflows.mouseterm.pages.dev

View logs

[dormouse-bot]

Build & Test is red for a reason unrelated to this diff: ubuntu-latest now resolves to ubuntu-26.04 (image 20261025.179.1), where main's last green CI run (04:53 today) ran on ubuntu-24.04. On the new image, shell-integration.test.js fails with bash reported ["__systemd_osc_context_precmdline"] for "true".

The test's bash sources /etc/profile through shellIntegration.bash, and on 26.04 that pulls in systemd's OSC-context snippet, whose hook function the preexec then reports as the command line. This probably isn't confined to CI: a user on a distro that ships that snippet would see the same wrong E. It needs its own fix, and main's next CI run should go red the same way. This PR's workflow changes don't touch that path, and Workflow Lint passes.

[dormouse-bot]

The red Build & Test is not from this diff. The job ran on the new ubuntu-26.04 runner image, where systemd's bash OSC-context hook makes bash: E is the whole submitted line… report __systemd_osc_context_precmdline. #1391 fixes that in the bash integration and is green on the same image. Re-running this PR's CI after #1391 merges should clear it.