Pin reusable workflow helper revision

[chubes4]

Summary

• Pins reusable-workflow helper checkout to immutable WP Codebox commit 54c2f9a7bc3cd1fe20055d496c83efcfb99afb41, independent of caller GitHub context.
• Validates the full SHA and verifies the Materialize external native agent packages #1754 helper files by historical SHA-256 digests.
• Documents the follow-up pin advancement workflow and records the affected Build runs.

Closes #1755.

Regression evidence

• https://github.com/Automattic/build-with-wordpress/actions/runs/29281470179
• https://github.com/Automattic/build-with-wordpress/actions/runs/29281470159

Compatibility

• No exposed reusable-workflow inputs, secrets, outputs, package behavior, native runtime behavior, or security policy changed. The helper-source resolution is now correctly independent of caller commits.

Tests

1. npm run build
2. npm run test:agent-task-workflow-interface
3. npx tsx tests/agent-task-reusable-workflow.test.ts
4. npm run test:external-native-package-materialization
5. npm run test:agent-task-runtime-package-staging
6. npm run test:agent-no-data-machine-loop
7. npm run test:production-boundary-enforcement
8. npm run test:php-provider-credential-boundary
9. npm run test:runtime-tool-policy
10. npm run test:php-runtime-package-canonical-importer
11. npm run test:php-runtime-package-public-contract
12. actionlint .github/workflows/run-agent-task.yml
13. git diff --check

npm run test:runtime-package-execution remains failing on its pre-existing artifact fixture mismatch: expected contentType and payloadSchema, but current runtime output omits both fields.

AI assistance

• AI assistance: Yes
• Tool(s): OpenAI GPT-5.6 Sol via OpenCode general coding subagent
• Used for: Investigated live workflow failure evidence, implemented the pinned helper revision and regression coverage, and ran verification.