ai: apply changes for #862 (1 review thread)

Addresses:
  - #3599032772 at .github/actions/bot-prelude/action.yml:27

Author: peco-engineer-bot[bot]

.github/actions/bot-prelude/action.yml

@@ -25,8 +25,13 @@ inputs:
     description: 'Bot App private key (PEM) for the same App.'
     required: true
   engine-ref:
+    # SINGLE SOURCE OF TRUTH for the engine pin. All four bot workflows route
+    # through this composite, so the SHA lives here once (overridable per-caller)
+    # instead of being duplicated — and drifting — across the callers. Bump this
+    # value to move every bot to a new engine commit; never @main.
     description: 'Engine commit SHA (full 40-char) to install.'
-    required: true
+    required: false
+    default: 'd9cb1e63dc31eed550194a29d1cfd7de9c9c793b'
   engine-repo:
     description: 'owner/name of the engine repo.'
     required: false

.github/workflows/engineer-bot-followup.yml

@@ -102,10 +102,9 @@ jobs:
         with:
           app-id: ${{ secrets.ENGINEER_BOT_APP_ID }}
           private-key: ${{ secrets.ENGINEER_BOT_APP_PRIVATE_KEY }}
-          # Pinned engine SHA. DUPLICATED in all four bot workflows
-          # (engineer-bot{,-followup}.yml, reviewer-bot{,-followup}.yml) — bump
-          # them in LOCKSTEP or the bots silently run different engine versions.
-          engine-ref: d9cb1e63dc31eed550194a29d1cfd7de9c9c793b
+          # Engine pin lives in ONE place: bot-prelude's `engine-ref` default.
+          # Bump it there to move all four bots in lockstep; override here only
+          # to run this workflow against a different engine commit.
 
       # Run the follow-up. Inlines the engine's bot-run env contract for
       # engineer:followup, plus the authenticated push remote bot-run would set

.github/workflows/engineer-bot.yml

@@ -90,10 +90,9 @@ jobs:
         with:
           app-id: ${{ secrets.ENGINEER_BOT_APP_ID }}
           private-key: ${{ secrets.ENGINEER_BOT_APP_PRIVATE_KEY }}
-          # Pinned engine SHA. DUPLICATED in all four bot workflows
-          # (engineer-bot{,-followup}.yml, reviewer-bot{,-followup}.yml) — bump
-          # them in LOCKSTEP or the bots silently run different engine versions.
-          engine-ref: d9cb1e63dc31eed550194a29d1cfd7de9c9c793b
+          # Engine pin lives in ONE place: bot-prelude's `engine-ref` default.
+          # Bump it there to move all four bots in lockstep; override here only
+          # to run this workflow against a different engine commit.
 
       - name: Resolve issue + gather context
         id: ctx

.github/workflows/reviewer-bot-followup.yml

@@ -77,10 +77,9 @@ jobs:
         with:
           app-id: ${{ secrets.REVIEW_BOT_APP_ID }}
           private-key: ${{ secrets.REVIEW_BOT_APP_PRIVATE_KEY }}
-          # Pinned engine SHA. DUPLICATED in all four bot workflows
-          # (engineer-bot{,-followup}.yml, reviewer-bot{,-followup}.yml) — bump
-          # them in LOCKSTEP or the bots silently run different engine versions.
-          engine-ref: d9cb1e63dc31eed550194a29d1cfd7de9c9c793b
+          # Engine pin lives in ONE place: bot-prelude's `engine-ref` default.
+          # Bump it there to move all four bots in lockstep; override here only
+          # to run this workflow against a different engine commit.
 
       - name: Run reviewer follow-up
         env:

.github/workflows/reviewer-bot.yml

@@ -8,8 +8,8 @@
 # checkout, Setup Python, and the run; bot-prelude mints tokens + Node + installs
 # the engine.
 #
-# Engine pin: the SHA below (in bot-prelude's engine-ref input) is the engine
-# commit installed; bump it deliberately, never @main.
+# Engine pin: the engine commit installed is bot-prelude's `engine-ref` default
+# (single source of truth for all four bots); bump it there, never @main.
 #
 # Auth: PAT-free — bot-prelude mints a short-lived, engine-scoped App token for
 # the install (no stored BOT_ENGINE_PAT).
@@ -82,10 +82,9 @@ jobs:
         with:
           app-id: ${{ secrets.REVIEW_BOT_APP_ID }}
           private-key: ${{ secrets.REVIEW_BOT_APP_PRIVATE_KEY }}
-          # Pinned engine SHA. DUPLICATED in all four bot workflows
-          # (engineer-bot{,-followup}.yml, reviewer-bot{,-followup}.yml) — bump
-          # them in LOCKSTEP or the bots silently run different engine versions.
-          engine-ref: d9cb1e63dc31eed550194a29d1cfd7de9c9c793b
+          # Engine pin lives in ONE place: bot-prelude's `engine-ref` default.
+          # Bump it there to move all four bots in lockstep; override here only
+          # to run this workflow against a different engine commit.
 
       - name: Resolve trigger inputs
         id: inputs