[pelikhan]

Upgrade the agent runtimes without adopting freshly published releases, and keep the gh-aw compiler, setup action, and generated workflows synchronized.

Changes

• Upgrade gh-aw from v0.93.1 to the latest stable release, v1.0.1, refresh its dispatcher, and regenerate all 15 agentic workflows. Preserve unrelated action pins.
• Upgrade eligible stable engines: Copilot CLI 1.0.105 / SDK 1.0.28, Codex 0.164.0, Gemini CLI 0.65.0, Pi 1.4.0, and Anthropic SDK 1.3.0. Reviewed release notes and verified each selected release was published at least 72 hours before selection.
• Pin direct SDK dependencies to the tested versions. Align Codex and Pi CLI/SDK versions and the standalone skill's Copilot SDK.
• Enforce a three-day npm release-age cooldown through repository and skill .npmrc files and workflow-level NPM_CONFIG_MIN_RELEASE_AGE, which also covers global installs and workflows without a checkout. Enable the declarative DeepSeek installation cooldown.
• Add 24 regression cases for cooldown enforcement and SDK pin alignment, and document the upgrade policy.

DeepSeek remains on 0.2.0-rc.2 because no stable release is available. Gemini remains supported by the existing manual integration despite gh-aw's deprecation warning; this does not migrate to the experimental Agy engine.

Validation

• All 738 unit tests pass; typecheck and lint pass.
• All 15 agentic workflows compile successfully.
• Relative documentation links and diff whitespace checks pass.
• Compilation retains warnings about the release checkout's credential persistence and a fixed daily schedule, plus the existing Gemini deprecation notice.

No live provider workflows or releases were dispatched.

[github-actions]

🧠 Matt Pocock Skills Reviewer is reviewing this pull request using Matt Pocock's engineering skills...