ci(aw): upgrade gh-aw toolchain to v0.88.2 to fix squid startup

.gitattributes

@@ -1 +1 @@
-.github/workflows/*.lock.yml linguist-generated=true merge=ours
+.github/workflows/*.lock.yml linguist-generated=true

.github/aw/actions-lock.json

@@ -5,10 +5,10 @@
       "version": "v9.0.0",
       "sha": "3a2844b7e9c422d3c10d287c895573f7108da1b3"
     },
-    "github/gh-aw-actions/setup@v0.72.1": {
+    "github/gh-aw-actions/setup@v0.88.2": {
       "repo": "github/gh-aw-actions/setup",
-      "version": "v0.72.1",
-      "sha": "bc56a0cad2f450c562810785ef38649c04db812a"
+      "version": "v0.88.2",
+      "sha": "9271a1804551c0dc4fb0085a97979950aa2f8489"
     }
   }
 }

.github/dependabot.yml

@@ -22,3 +22,9 @@ updates:
     directory: "/"
     schedule:
       interval: "monthly"
+    ignore:
+      # The *.lock.yml workflows are `gh aw compile` output. Bumping this pin on its own
+      # desynchronises it from the awf binary version, the gh-aw-firewall image tag and the
+      # embedded gh-aw-manifest header, which only a recompile can move together. Update it
+      # with `gh aw compile` instead.
+      - dependency-name: "github/gh-aw-actions/setup"

.github/workflows/copilot-setup-steps.yml

@@ -21,6 +21,6 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install gh-aw extension
-        uses: github/gh-aw-actions/setup-cli@f3ca20900e2363607992fb61b46fc687d4b56ba3 # v0.84.0
+        uses: github/gh-aw-actions/setup-cli@9271a1804551c0dc4fb0085a97979950aa2f8489 # v0.88.2
         with:
           version: v0.68.3

.github/workflows/issue-triage.md

@@ -15,17 +15,53 @@ permissions: read-all
 
 network: defaults
 
+# Adds --diagnostic-logs to the awf invocation, so container logs and exit codes land under
+# sandbox/firewall/ in the `agent` artifact. Upstream calls this the "firewall-audit-logs"
+# artifact; the compiler folds it into `agent`.
+# See https://github.github.com/gh-aw/reference/feature-flags/
+features:
+  awf-diagnostic-logs: true
+
 # # This workflow runs often, so you can use a small model to keep costs down.
 # engine:
 #   model: small
 
 safe-outputs:
   add-labels:
     max: 5
+    # Enforcement only — this list is not shown to the agent, it just rejects anything off it.
+    # The agent discovers labels from step 3 of the prompt below, which repeats this list;
+    # keep the two in sync. Mirrors `gh label list` minus `dependencies` / `javascript` /
+    # `github_actions`, which belong to Dependabot.
+    allowed:
+      [
+        bug,
+        documentation,
+        duplicate,
+        enhancement,
+        good first issue,
+        help wanted,
+        invalid,
+        question,
+        wontfix,
+        seo,
+        design,
+        agentic-workflows,
+        high-priority,
+        med-priority,
+        low-priority,
+        future,
+        revisit,
+      ]
   add-comment:
 
 tools:
   web-fetch:
+  # Required explicitly under the compiler's strict mode because github.min-integrity is
+  # 'none'. The prompt's only shell need is `gh label list` (step 3), and the default shell
+  # set gh-aw grants (cat, grep, ls, yq, ...) does not include `gh` — dropping this entry
+  # silently takes that step away.
+  bash: ["gh label list"]
   github:
     toolsets: [issues]
     min-integrity: none # This workflow is allowed to examine and comment on any issues
@@ -45,7 +81,7 @@ You're a triage assistant for GitHub issues. Your task is to analyze issue #${{
 2. Retrieve the issue content using the `get_issue` tool. If the issue is obviously spam, or generated by bot, or something else that is not an actual issue to be worked on, then add an issue comment to the issue with a one-sentence analysis and exit the workflow.
 
 3. Next, use the GitHub tools to gather additional context about the issue:
-   - Fetch the list of labels available in this repository. Use 'gh label list' bash command to fetch the labels. This will give you the labels you can use for triaging issues.
+   - Fetch the list of labels available in this repository with the `gh label list` bash command. The sandbox is network-isolated, so that command may return nothing; if it does, use this list, which is what `safe-outputs.add-labels.allowed` enforces: `bug`, `documentation`, `duplicate`, `enhancement`, `good first issue`, `help wanted`, `invalid`, `question`, `wontfix`, `seo`, `design`, `agentic-workflows`, `high-priority`, `med-priority`, `low-priority`, `future`, `revisit`. Labels outside it are rejected.
    - Fetch any comments on the issue using the `get_issue_comments` tool
    - Find similar issues if needed using the `search_issues` tool
    - List the issues to see other open issues in the repository using the `list_issues` tool

.prettierignore

@@ -7,3 +7,6 @@ next-env.d.ts
 .husky/_/
 .claude/settings.local.json
 .claude/worktrees/
+# `gh aw compile` output. Prettier rewrites the quoting and splits `run: | # zizmor: ignore[...]`
+# onto two lines, detaching the directive from the step it annotates. Update via `gh aw compile`.
+.github/workflows/*.lock.yml

AGENTS.md

@@ -51,5 +51,6 @@ pnpm check:og-image   # postbuild social-card guard over ./out (runs inside `pnp
 - **`metadataBase` is live.** `lib/links.ts` `site` is the real origin and `INDEXABLE` is `true`. Anything anchored on this origin — OG and canonical (via `metadataBase`); JSON-LD, `app/sitemap.xml/route.ts`, `app/sitemap-pages.xml/route.ts`, `app/robots.txt/route.ts` (via `SITE_URL`) — ships to production. Adding a new non-blog page = append an entry to `app/sitemap-pages.xml/route.ts`; blog posts auto-derive from `content/blog/` and legal pages from the closed `LEGAL_SLUGS` list in `lib/legal.ts`. Flip `INDEXABLE` to mark pages noindex; `robots.txt` and the sitemap remain unchanged by design (see `lib/links.ts` for why). `app/llms.txt/route.ts` and `app/llms-full.txt/route.ts` ship to the same origin and derive their page entries from `listPosts()` / `LEGAL_SLUGS` / `lib/copy.ts`; both are listed in `app/sitemap-pages.xml/route.ts` and advertised via `alternates.types` in `app/layout.tsx` and a `Link:` header in `public/_headers`. Deriving entries is not by itself a guarantee that a URL exists — the sitemap's two llms entries are literals, and the litepaper, press kit and `docs.decdn.org` entries are not routes at all. `scripts/check-out.mjs` is what resolves every advertised same-origin URL against `out/` after a build; `scripts/check-og-image.mjs` does the same for every `og:image` / `twitter:image` in every built page, plus every `sitemap-pages.xml` `<loc>`.
 - **`docs/` is a different product.** Mintlify Cloud builds it from `docs/docs.json` and serves it at `docs.decdn.org` — independent of `pnpm build`. The website code must not import from `docs/`; ESLint and the website CI workflow ignore it. Edits to MDX go through the `docs` workflow (Prettier + `markdownlint-cli2` + `mintlify broken-links`).
 - **vitest only collects `**/\*.test.ts`.** A `.test.tsx`is silently skipped — the suite stays green and the file never runs. Component tests therefore contain no JSX: call the component as the plain function it is and walk the result with`test-utils/react-tree.ts`(or`React.createElement` for fixtures).
+- **`.github/workflows/*.lock.yml` are generated.** `gh aw compile` (the `github/gh-aw` gh extension) produces them from the sibling `.md` — `issue-triage.md`, `cost-tracker.md`. Edit the `.md` and recompile; never the lock. They are `linguist-generated`, prettier-ignored (prettier rewrites their quoting and breaks the `run: | # zizmor: ignore[...]` line), and the `github/gh-aw-actions/setup` pin is Dependabot-ignored because it has to move together with the `gh-aw-firewall` image tags a recompile writes. **Nothing in CI checks that a lock file matches its source**, so editing the `.md` alone ships a workflow whose behaviour has silently diverged. Same reasoning on a merge conflict in a lock file: take either side and recompile rather than resolving it by hand.
 - **CI typechecks separately.** `next build` only typechecks what it bundles, so test files are invisible to it — one had a type error on `main`. `pnpm typecheck` is a distinct CI step.
 - **CSS custom properties in `style` props.** Known `--var` names are declared in `types/css.d.ts` (module-augmenting React's `CSSProperties`) so call sites can write `style={{ "--reveal-delay": "120ms" }}` without a cast. Add new vars there before using them.