build(deps): bump ci-workflows to v0.17.2

[kyle-sexton]

No linked issue

Summary

Review-only pin drain for the repository-pin:melodic-software/ci-workflows row of #283. Moves all 21 melodic-software/ci-workflows uses: references from v0.17.0 (d26c750) to v0.17.2 (0f8176e) as one reviewed compatibility pin.

Merge order for the whole cycle: this PR → #310 → #311. This one is the hard prerequisite — it is what brings golangci-lint 2.13.1 into the shared go-quality lane, without which #310 cannot lint a go1.27 module. #311 goes last so that #310's wholesale rewrite of release/dependency-drift-review.json does not silently regress #311's merged decision.

This PR carries the do-not-merge label and must not be merged autonomously. docs/releases.md ("Freshness policy") states: never auto-merge controller, runner, image, toolchain, Scale Set Client, Action, or release changes, and a passing drift check is necessary but is not promotion approval. Remove the label to sign off.

Problem

The drift table pins ci-workflows at d26c750 (v0.17.0). The freshness check reports "latest" as the default-branch HEAD (e3d93da at the 2026-08-26 run; already 49c6b08 today), which is untagged. The reviewed-pin contract targets published releases, so the correct bump target is the newest release tag, v0.17.2 = 0f8176e87e0be518f382664779655011bf95784a — not the branch HEAD the table names.

The row will therefore continue to report drift after this PR, by design: scripts/Test-DependencyFreshness.ps1 compares the pin against default_branch HEAD, and docs/releases.md says a held/partially-drained row keeps being reported until a dedicated compatibility PR moves every reference together.

Fix

• All 21 uses: references move together to 0f8176e87e0be518f382664779655011bf95784a # v0.17.2 across ci.yml (17), do-not-merge.yml, link-check.yml, pr-issue-linkage.yml, pr-title.yml.
• .github/scripts/workflow-pin-metadata.test.cjs: ciWorkflowsSha / ciWorkflowsVersion constants and their assertion messages.
• release/dependencies.json: repositoryPins[melodic-software/ci-workflows].commit and .source, plus resolvedAt → 2026-08-27T08:00:00Z (it still claimed the pins were resolved on 2026-08-21, which stops being true once this pin moves; build(deps): bump setup-buildx-action to 4.3.0 and ci-workflows to v0.17.0 #291 set the same precedent of matching resolvedAt to the reviewed-decision instant). No CI check reads that field.
• No change to release/dependency-drift-review.json — its bumped array is the historical 2026-08-21 cycle log, and the live Go hold it records is unaffected by this PR.

Upstream change review, d26c750...0f8176e

14 files changed upstream. Only two are reusables this repo consumes:

Consumed reusable	Change
.github/workflows/go-quality.yml	GOLANGCI_LINT_VERSION 2.12.2 → 2.13.1 with new GOLANGCI_LINT_SHA256 for both the Linux and Windows lanes. No input, permission, or step changes.
.github/actions/check-jsonschema/action.yml	astral-sh/setup-uv v9.0.0 (c771a70) → v10.0.0 (ae62891). No input changes.

Every other gate reusable this repo calls is byte-identical to v0.17.0: semantic-pr.yml, do-not-merge-gate.yml, pr-issue-linkage.yml, link-check.yml, zizmor.yml, and the markdown, shellcheck, shfmt, typos, editorconfig, gitleaks, lychee-offline, comment-hygiene, actionlint, exec-bit, machine-specific-paths, eol-renormalize, ci-status actions.

The remaining 12 changed files are not referenced by this repo: the biome, pyright, and ruff actions, .github/osv-scanner-pin.json, osv-scanner.yml, the four claude-* workflows, README.md, and ci-workflows' own internal tests .github/scripts/go-quality.test.cjs and .github/scripts/resolve-npm-tool-version.test.cjs (upstream test files, not consumable by a caller).

Breaking-change assessment

The only behavioral risk is the golangci-lint 2.12.2 → 2.13.1 delta (errcheck 1.10→1.20, exhaustruct deprecation), which could surface new findings against existing code. Empirically it does not — see Verification.

Verification

• gh release view v0.17.2 --repo melodic-software/ci-workflows targets 0f8176e87e0be518f382664779655011bf95784a; confirmed against the Git tag API.
• Upstream diff reviewed file-by-file via GET /repos/melodic-software/ci-workflows/compare/d26c750...0f8176e (14 files; table above).
• node --test .github/scripts/workflow-pin-metadata.test.cjs → 5/5 pass (enforces all 21 references move as one SHA + one version, and that release/dependencies.json tracks the same release).
• ./scripts/Test-ReleasePins.ps1 → "Release and workflow pins are internally consistent."
• Linter delta qualified locally. golangci-lint v2.13.1 built from source per the AGENTS.md contract (GOTOOLCHAIN=go1.26.6 GOFLAGS=-mod=mod go install .../golangci-lint@v2.13.1) and run as golangci-lint run ./... against this module: 0 issues, identical to the v2.12.2 baseline (also 0 issues) on the same tree.
• No Go source changes in this PR.

Related

• [dependency-drift] Runner fleet pins require review #283 — standing dependency-drift evidence issue. Deliberately not closed by this PR, and this body carries no closing keyword. The daily dependency-drift.yml job reconciles that issue itself: it closes the issue when hasDrift is false, and otherwise refreshes the body of whichever matching issue is currently state: 'open'. It never reopens a closed one — if the issue is closed manually while rows remain outstanding, the next run finds no open match and creates a duplicate, which is exactly what the 2026-08-21 maintainer note warns about.
• docs/releases.md — freshness policy and the never-auto-merge rule this PR obeys.
• ci-workflows v0.17.1, v0.17.2
• build(deps): bump setup-buildx-action to 4.3.0 and ci-workflows to v0.17.0 #291 — the previous drain of this same row (v0.14.2 → v0.17.0), whose PR body this one follows.
• Prerequisite for the queued Go 1.26.6 → 1.27.0 bump: golangci-lint ≥ 2.13.0 is required to lint a go1.27 module (golangci-lint#6643), and v0.17.2 is what brings 2.13.1 into the shared go-quality lane. That bump is stacked on this branch.

Fleet rollout

Not required. This PR changes CI workflow pins only — no runtime, no compatibility.json input, no worker-image content. It does not require a rolling-host rollout.

---

This PR was prepared by an automated agent lane. It is review-only: the agent did not merge it and will not, and deliberately left issue 283 open.