land: gh-shim-rename-guard

[aft-alfonso]

Accepted agent delivery; branch-keyed search descriptor included.

---

Summary by cubic

Adds a preflight guard to operator-bypassed repo rename so it refuses when the repository publishes reusable workflows or actions that other repositories reference, since GitHub does not redirect those references after a rename. The check fails closed when it cannot verify the repository is safe (API errors, truncated trees, unparseable workflow YAML, or limits).

• Operators can override the refusal with GH_SHIM_RENAME_PUBLISHED=allow, which still runs the bounded inspection but records the published paths or unverified reason in the operator audit.
• New refusal codes gh_shim_rename_published and gh_shim_rename_unverified are added to the closed set.
• Process-tree cleanup for preflight timeouts is shared across the crate, and the timeout tests now tolerate loaded runners.

^{Written for commit 431a7f9. Summary will update on new commits.}

Confidence Score: 5/5

The PR appears safe to merge; no new actionable issue was found.

Summary

Adds a preflight check before operator-bypassed repo rename to detect reusable workflows and actions.

• Operator-bypassed repository renames check for published actions and workflows.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Operator-bypassed repo rename] --> B[Inspect repository]
  B --> C{Safe or explicit override?}
  C -->|No| D[Refuse rename]
  C -->|Yes| E[Write and sync audit]
  E --> F{Audit saved?}
  F -->|No| D
  F -->|Yes| G[Delegate to gh]

Loading

_{Reviews (3) · Last reviewed commit: "gh-shim: leave room for nested PowerShel..." · Reviewed by Greptile}