Upgrade gh-aw to v0.91.9 and resolve workflow lint findings

Persist the Actions-generated Pi 1.2.0 dependency lockfile and remove the temporary bootstrap workflow. Preserve Codex native shell disablement and Gemini manual-only coverage.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: pelikhan

.github/agents/agentic-workflows.md

@@ -31,6 +31,7 @@ This is a **dispatcher agent** that routes your request to the appropriate speci
 - **CLI commands and triggering workflows**: Routes to `cli-commands` guide — consult this whenever the user asks how to run, compile, debug, or manage workflows from the command line, or when they need the MCP tool equivalent of a `gh aw` command
 - **Reducing token consumption / cost optimization**: Routes to `token-optimization` guide — consult this whenever the user asks how to reduce token usage, lower costs, speed up workflows, or measure the impact of prompt changes with experiments
 - **Choosing workflow architectures and design patterns**: Routes to `patterns` guide — consult this whenever the user asks for strategy, architecture, operating models, or pattern selection for agentic workflows
+- **Git-backed work queues**: Routes to `work-queue` instructions for producers, dispatchers, workers, observers, deployment and recovery
 
 Workflows may optionally include:
 
@@ -184,6 +185,15 @@ loops using explicit live gates and includes existing-run evidence triage.
 
 ## Instructions
 
+### Work Queue
+
+For queue design, deployment, inspection or recovery, load
+`https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/work-queue.md`.
+Also load it after the primary create/update/debug/upgrade prompt whenever a
+workflow uses `tools.work-queue`. Load linked developer docs and specifications
+only when needed; do not substitute lightweight WorkQueueOps backlog guidance
+for the Git-backed protocol.
+
 When a user interacts with you:
 
 1. **Identify the task type** from the user's request

.github/aw/actions-lock.json

@@ -10,15 +10,15 @@
       "version": "v7.0.2",
       "sha": "cf430e030ddbb5b0abf93d22962f4752f3646cd9"
     },
-    "github/gh-aw-actions/setup-cli@v0.91.5": {
+    "github/gh-aw-actions/setup-cli@v0.91.9": {
       "repo": "github/gh-aw-actions/setup-cli",
-      "version": "v0.91.5",
-      "sha": "16b430146d5d5646eccef5a1ceb72152333b18b9"
+      "version": "v0.91.9",
+      "sha": "a0486bb9f7e2d8b990201dc43e34e7d668f191a4"
     },
-    "github/gh-aw-actions/setup@v0.91.5": {
+    "github/gh-aw-actions/setup@v0.91.9": {
       "repo": "github/gh-aw-actions/setup",
-      "version": "v0.91.5",
-      "sha": "16b430146d5d5646eccef5a1ceb72152333b18b9"
+      "version": "v0.91.9",
+      "sha": "a0486bb9f7e2d8b990201dc43e34e7d668f191a4"
     }
   },
   "containers": {

.github/skills/agentic-workflows/SKILL.md

@@ -31,6 +31,7 @@ Load these files from `github/gh-aw` (they are not available locally).
 - `.github/aw/create-agentic-workflow.md`
 - `.github/aw/create-shared-agentic-workflow.md`
 - `.github/aw/debug-agentic-workflow.md`
+- `.github/aw/debug-security-review.md`
 - `.github/aw/dependabot.md`
 - `.github/aw/deployment-status.md`
 - `.github/aw/designer-mappings.md`
@@ -46,6 +47,7 @@ Load these files from `github/gh-aw` (they are not available locally).
 - `.github/aw/instructions.md`
 - `.github/aw/intent.md`
 - `.github/aw/jobs.md`
+- `.github/aw/ledger.md`
 - `.github/aw/linter-workflows.md`
 - `.github/aw/llms.md`
 - `.github/aw/loop.md`
@@ -98,6 +100,7 @@ After loading the matching workflow prompt or skill, follow it directly:
 - Configure or add declarative engines: `.github/aw/configure-agentic-engine.md`
 - Update existing workflows: `.github/aw/update-agentic-workflow.md`
 - Diagnose, patch, audit, or actively debug workflows: `.github/aw/debug-agentic-workflow.md` (local-first strategy, evidence triage and live gates)
+- AWF model/endpoint 400s, silent cross-family sub-agent failures, `model: auto` failures, install-step 404s after a version pin, or questions about version fields: go directly to [Model and engine misconfiguration](https://github.com/github/gh-aw/blob/main/.github/aw/debug-agentic-workflow.md#model-and-engine-misconfiguration) before suggesting model changes.
 - Upgrade workflows and fix deprecations: `.github/aw/upgrade-agentic-workflows.md`
 - Create shared components or MCP wrappers: `.github/aw/create-shared-agentic-workflow.md`
 - Create report-generating workflows: `.github/aw/report.md`
@@ -106,9 +109,11 @@ After loading the matching workflow prompt or skill, follow it directly:
 - Render compact markdown charts: `.github/aw/asciicharts.md`
 - Map CLI commands to MCP usage: `.github/aw/cli-commands.md`
 - Choose workflow architecture and patterns: `.github/aw/patterns.md`
-- Orchestrate durable work with a work queue (dispatcher/worker roles or queue inspection): `.github/aw/work-queue.md`
+- Design, deploy, inspect or recover a Git-backed work queue: `.github/aw/work-queue.md`
 - Optimize token usage and cost: `.github/aw/token-optimization.md`
 - Design long-running multi-agent research workflows: `.github/aw/multi-agent-research.md`
 - Add skills or agent plugins requested by the user (`skills:` / `plugins:` frontmatter, never on-the-fly installs): `.github/aw/skills.md`
 
 When the task involves OTEL, OTLP, traces, observability backends, or telemetry-driven analysis, also read and follow `skills/otel-queries/SKILL.md` after loading the matching workflow prompt or skill.
+
+When creating, updating, diagnosing or upgrading a workflow that uses `tools.work-queue`, also load `.github/aw/work-queue.md` after the primary prompt. Load deployment docs, operator reference or specification only when that task needs them.

.github/workflows/agentic-auto-upgrade.yml

@@ -1,4 +1,4 @@
-# This file was automatically generated by pkg/workflow/auto_update_workflow.go (v0.91.5). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
+# This file was automatically generated by pkg/workflow/auto_update_workflow.go (v0.91.9). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
 #    ___                   _   _
 #   / _ \                 | | (_)
@@ -52,17 +52,17 @@ jobs:
           persist-credentials: false
 
       - name: Install gh-aw
-        uses: github/gh-aw-actions/setup-cli@16b430146d5d5646eccef5a1ceb72152333b18b9 # v0.91.5
+        uses: github/gh-aw-actions/setup-cli@a0486bb9f7e2d8b990201dc43e34e7d668f191a4 # v0.91.9
         with:
-          version: v0.91.5
+          version: v0.91.9
 
       - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@16b430146d5d5646eccef5a1ceb72152333b18b9 # v0.91.5
+        uses: github/gh-aw-actions/setup@a0486bb9f7e2d8b990201dc43e34e7d668f191a4 # v0.91.9
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
 
       - name: Run upgrade notification
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GH_AW_OPERATION: upgrade

.github/workflows/agentic_commands.yml

@@ -1,10 +1,10 @@
-# gh-aw-commands: {"payload_version":"v1","schema_version":"v1","compiler_version":"v0.91.5","commands":["matt"],"workflows":["mattpocock-skills-reviewer"]}
+# gh-aw-commands: {"payload_version":"v1","schema_version":"v1","compiler_version":"v0.91.9","commands":["matt"],"workflows":["mattpocock-skills-reviewer"]}
 # Routing summary (sorted):
 #   slash commands:
 #     /matt -> mattpocock-skills-reviewer [pull_request_comment,pull_request_review_comment] reaction=eyes
 #   labels:
 #     (none)
-# This file was automatically generated by gh-aw (v0.91.5). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
+# This file was automatically generated by gh-aw (v0.91.9). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
 #    ___                   _   _
 #   / _ \                 | | (_)
@@ -54,12 +54,12 @@ jobs:
           persist-credentials: false
 
       - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@16b430146d5d5646eccef5a1ceb72152333b18b9 # v0.91.5
+        uses: github/gh-aw-actions/setup@a0486bb9f7e2d8b990201dc43e34e7d668f191a4 # v0.91.9
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
 
       - name: Route slash command
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         # runner-guard:ignore RGS-016 -- routing tables below contain emoji variation selectors (U+FE0F) and zero-width joiners (U+200D) used to render standard emoji sequences, not steganographic payloads.
         env:
           GH_AW_SLASH_ROUTING: '{"matt":[{"workflow":"mattpocock-skills-reviewer","events":["pull_request_comment","pull_request_review_comment"],"ai_reaction":"eyes","emoji":"🔍","status_comment":true}]}'