Run Docs Agent through the native executor

[chubes4]

Summary

• Pin the native technical-maintenance consumer to merged Docs Agent Workflows: close the cron loop — listener for wp_agent_workflow_run_scheduled #121 and verify its complete Docs Agent to WP Codebox producer chain against both merge commits.
• Forward only OPENAI_API_KEY and EXTERNAL_PACKAGE_SOURCE_POLICY; Docs Agent publishes with the caller-scoped built-in GitHub token and declared write permissions.
• Make producer validation mandatory in CI and local runs, and run actionlint with repository workflow discovery rather than a literal glob.

Related: Automattic/docs-agent#117, Automattic/docs-agent#120, Automattic/docs-agent#121, Automattic/wp-codebox#1754.

How to test

1. Clone Automattic/agents-api and check out this PR branch.
2. Run composer install --no-interaction --prefer-dist, composer validate --strict, and composer test.
3. Check out Automattic/docs-agent at 5344a4bfbda4a0553cc92636258e46a715b1c72d and Automattic/wp-codebox at 54c2f9a7bc3cd1fe20055d496c83efcfb99afb41.
4. Run DOCS_AGENT_DIR=/path/to/docs-agent WP_CODEBOX_DIR=/path/to/wp-codebox php tests/docs-agent-native-workflow-contract.php. The test fails with this exact command when either producer checkout is absent or not pinned.
5. Run actionlint and git diff --check.

Required secret setup

Configure only these repository secrets before manually dispatching Docs Agent:

• OPENAI_API_KEY: required for a live OpenAI Docs Agent run.
• EXTERNAL_PACKAGE_SOURCE_POLICY:

{"version":1,"repositories":{"automattic/docs-agent":["bundles/technical-docs-agent/native/technical-docs-bootstrap-agent.agent.json","bundles/technical-docs-agent/native/technical-docs-maintenance-agent.agent.json","bundles/user-docs-agent/native/user-docs-bootstrap-agent.agent.json","bundles/user-docs-agent/native/user-docs-maintenance-agent.agent.json","bundles/skills-agent/native/skills-maintenance-agent.agent.json"]}}

Live-run prerequisites

The Docs Agent workflow is manual only. It grants contents: write, pull-requests: write, and issues: write; merged Docs Agent #121 forwards the caller workflow github.token for same-repository branch and pull-request publication. No consumer ACCESS_TOKEN secret is required.

Compatibility impact

This intentionally removes the consumer ACCESS_TOKEN secret. Live OpenAI runs require OPENAI_API_KEY; native package authorization remains separately controlled by EXTERNAL_PACKAGE_SOURCE_POLICY. No Agents API runtime API changes.

AI assistance

• AI assistance: Yes
• Tool(s): OpenAI GPT-5.6 Terra via OpenCode native coding tools
• Used for: Collaboratively updated the native Docs Agent consumer, strengthened pinned producer-contract coverage, and ran deterministic verification.