[ivanpaghubasan]

Summary

Adds the new CI- family (AGS-07): coding agents running in GitHub Actions on events any GitHub user can cause, while holding write tokens, secrets, persisted git credentials or unrestricted shell. Requires the engine changes in #264 (same branch name). The pack moves to schema_version 24 and from 340 to 345 rules.

Rules

ID	Title	Severity	Confidence
CI-001	Agent step runs on an untrusted trigger without an actor gate	critical	0.7
CI-002	Ungated agent job holds a write token or extra secrets	critical	0.75
CI-003	Checkout persists credentials in an agent job	high	0.7
CI-004	Agent step grants unrestricted shell	high	0.8
CI-005	Agent job with shell or web access has no egress restriction	medium	0.5

Files

• ci/untrusted_triggers.yaml (CI-001, CI-002), ci/agent_hardening.yaml (CI-003, CI-004, CI-005)
• manifest.yaml: schema_version 24
• README.md, CLAUDE.md: family entries and rule count

The two YAML files are byte-identical to the engine's testdata/rules-fixture/ci/.

Notes

• Each rule's explanation states the limits of its check, taken from the predicate source: expressions are matched as text and not evaluated, remote reusable workflows are not followed, and permissions, secrets and credentials set up outside the workflow file are not visible.
• Explanations contain only claims traced to the actions' own documentation, the actions/checkout README, the Gemini CLI configuration docs and the Codex CLI source. The word check (frequency words, versions, percentages) has no hits.
• The report's actions/cache sub-condition for CI-002 was dropped; see the engine PR for the reason.
• CI-003 fires on some vendor example workflows that use a default checkout in an agent job on an untrusted trigger (claude.yml, claude-wif.yml, issue-deduplication.yml, issue-triage.yml in claude-code-action's examples). This is intended.

Merge order

Engine #264 first, then this PR. Rationale docs for CI-001..005 follow in the rulebook repo; please do not merge this PR before that docs PR is ready, because the rulebook gate fails on any shipped rule without a rationale doc.