fix(dx): repair onboarding docs and workflow hygiene

[aaltshuler]

Summary

• make the cluster and general quickstarts executable with canonical graph-level NDJSON, policy, authentication, and stored-query examples
• remove stale configuration and governance templates; repair broken links, anchors, labels, and the bundled skill reference
• document the source-build protobuf prerequisite and a focused contributor build/test loop
• pin every external GitHub Actions reference to an immutable SHA, move JavaScript actions to Node 24 releases, and enforce pinning in CI and declarative branch protection

Validation

• literal cluster quickstart: validate, import, plan, apply, load, serve, and authenticated query (HTTP 200)
• cargo test -p omnigraph-cluster --lib queries_directory_discovers_every_declaration -- --nocapture
• cargo test -p omnigraph-cli --test system_local local_cli_operator_alias_and_server_flag_invoke_stored_query -- --exact --nocapture
• cargo fmt --all --check
• actionlint .github/workflows/*.yml
• shellcheck scripts/*.sh
• python3 -B scripts/check-workflow-action-pins.py
• bash scripts/check-agents-md.sh
• Markdown link/anchor scan, YAML parse, JSON parse, and git diff --check

Operational note

After merge, rerun scripts/apply-branch-protection.sh as an administrator to activate the new required Check Workflow Action Pins context.

---

Greptile Summary

The PR repairs onboarding and contributor documentation while strengthening workflow hygiene through immutable action references and a required pin-validation check.

• Adds complete quickstart examples for graph data, stored queries, policy, authentication, and cluster operation.
• Pins external actions and reusable workflows to commit SHAs and updates release action versions.
• Documents source-build prerequisites and focused contributor validation commands.
• Removes stale configuration and governance templates and repairs documentation links.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
scripts/check-workflow-action-pins.py	Adds a CI validator that rejects external workflow references not pinned to full commit SHAs.
.github/workflows/ci.yml	Adds the action-pin validation job and updates the public-Rust tool cache action.
.github/workflows/release.yml	Pins and upgrades release actions while explicitly selecting PowerShell for Windows packaging.
docs/user/clusters/index.md	Expands the cluster quickstart with schema, stored-query, policy, data-loading, and authenticated invocation examples.
docs/user/quickstart.md	Documents the canonical graph-level NDJSON load format and links to the full CLI load contract.
scripts/install-source.sh	Fails early with actionable guidance when the required Protocol Buffers compiler is unavailable.

_{Reviews (2): Last reviewed commit: "fix(docs): use graph-facing result vocab..." | Re-trigger Greptile}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.