[jaschadub]

User-authorized manual publisher for the compatible Rust-only security backport merged in #11. This does not publish main's newer protocol.

• No inputs; only jaschadub may dispatch/re-run from main in this repository.
• Source fixed to 780144e; package fixed to agentpin@0.3.1.
• Read-only GitHub permissions, pinned checkout/artifact actions and Rust1.99.
• Separate fresh runners for validation and publication. Tests, package verification and audit receive no publication secret.
• Transfer only the tested lockfile by exact artifact ID; verify SHA256. No build caches or executables cross jobs.
• Only the final cargo publish --locked --no-verify step receives the existing CARGO_REGISTRY_TOKEN. Verification runs beforehand in the unprivileged job.
• Constant concurrency group prevents simultaneous runs.

Workflow lint and local package verification pass. This is intentionally limited to one reviewed release, not a general-purpose publisher.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-29T05:38:44.442884Z	9918159	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.