Roll out manual workflow-fix recovery and retire the opt-in

[devantler]

🤖 Generated by the Agentic Engineer

Outcome

Adopt the default-off manual-workflow-fixes option introduced by #1162 for #703, then retire the temporary rollout flag after consumer evidence. Part of #558.

Acceptance criteria

• Enumerate current lint.yaml and validate-go-project.yaml callers, their Actions pins, and artifact eligibility.
• Opt in pilot callers after the shared fix is released, using pinned Actions revisions.
• Record an eligible same-repository PR where a workflow-file formatter fix produces one complete downloadable patch, including related ordinary edits, without requesting workflow-write permission or attempting an automatic workflow-file commit.
• Apply the downloaded patch in a clean checkout and verify its complete resulting tree.
• Exercise a formatter fix together with an unfixable lint error: the patch remains downloadable, the lint job still fails, and no signer writes occur.
• Verify omitted/false inputs preserve existing routing, ordinary fixes still sign, and fork, bot, read-only, and cancellation boundaries remain intact.
• Roll out remaining consumers with their own review and CI evidence.
• Change the default only after successful rollout, then remove the flag, concurrency discriminator, and obsolete flag-state fixtures while retaining recovery and authority coverage.

The flag remains false until rollout is validated. No consumer activation is implied by this task. Rough size: M.

[devantler]

🤖 Generated by the Agentic Engineer

The shared recovery option is released in v13.4.1 at 36e6129: https://github.com/devantler-tech/actions/releases/tag/v13.4.1 . Implementation #1162 merged as d775642; its tree matches the fully reviewed and tested PR head.

The release keeps manual-workflow-fixes false by default. Both hosted flag states passed, with 56 real patch-replay fixtures and 3,456 recovery/status/authority cases. Actual consumer activation and a hosted mixed lint-error/artifact recovery run remain the pilot acceptance work above. No consumer has been opted in by this release or this comment.