[netopsengineer]

Security boundary

Remove both the PR-produced auto-fix artifact and its privileged consumer. A failed Validate run is now only a wake-up signal. The base-owned workflow uses its immutable code, locked Ruff binary and explicit configuration to derive Python-only fixes from immutable API blobs, without checking out, importing, installing, or executing PR code or hooks.

• Authenticate current run/attempt/workflow, stable Dependabot IDs, same repository, open current PR, branch and exact head.
• Allow only existing regular Python source paths in both base and head trees. Protect workflows, hooks, scripts, CODEOWNERS, Dependabot configuration, policy, packaging and lockfiles.
• Mint the unchanged Contents-write App token only after nonempty trusted derivation. Revalidate, then atomically create the commit with expectedHeadOid; no force update or artifact trust.
• Recheck current head around bot approval, dismiss detected stale review, and match head when enabling auto-merge.
• Add daily Validate/Release reconciliation for bot merges whose GITHUB_TOKEN push suppresses downstream events, preserving existing jobs, permissions and publishing gates.

Intentional tradeoff

No arbitrary hook execution, automatic lock regeneration, Markdown rewriting, or PR-selected formatter version in the writer. Dependabot and all required checks remain enabled; unsupported migrations remain red for reviewed maintenance. Full threat model and residual metadata race documented in docs/autofix-threat-model.md.

Verification

• 821 tests passed, 100% line and branch coverage.
• 172 adversarial auto-fix tests, including real Ruff proof that hostile source/config/hooks/shadow imports never execute.
• Full prek gate passed, including Pyright, Ruff, pydoclint, Bandit, gitleaks, actionlint and zizmor 1.31.0.
• Clean sdist and wheel build passed.
• Independent read-only security review: no blocking findings. No external review upload.
• Live App mutation not artificially exercised; Contents-write compatibility is based on GitHub's documented API and unit tests. The existing App remains Contents-write only; the read-only job additionally requests pull-requests:read for provenance. No new write permission, persistent credential, secret, or ruleset change.

This CI-only maintenance change does not request a new runtime release; existing release behavior is unchanged.

Release-impact preflight

Current main is 6a7e016; this PR head is c47fc64. Latest v0.2.6 resolves to 4e43070. Inspected every intervening commit body: no release-driving type or breaking-change marker. Pinned python-semantic-release 10.7.0, run read-only on the proposed tree/history under a local main branch, reports 0.2.6 already released, no new release. Built wheel has no runtime dependencies and does not include scripts/autofix.py. Keep squash title ci: derive auto-fixes only from trusted base tools (#88); no new distribution is needed for this CI boundary change.