0.1.6

• Added explicit Dependabot-safe advanced CodeQL routing. Ordinary private
  analysis and Dependabot pull requests can use separate reviewed runner
  classes while preserving stable language check identities and a secretless
  pull_request trust boundary.
• Added validated opt-in dependency cache inputs to python-ci.yml pip callers
  and node-ci.yml npm/pnpm/Yarn callers. Cache backends must match the package
  manager and dependency paths cannot be supplied without enabling a cache.
• Treat OSV Scanner's exact No package sources found result as a successful
  empty inventory while preserving failure for vulnerabilities and all other
  errors. The first MyAttention consolidation ring exposed this in an
  observability-schema repository with no package manager files.
• Fixed nddev-security-bundle.yml to supply all four evidence paths required
  by the shared scanner and upload the redacted one-day evidence bundle. The
  first public-product consumer ring exposed the missing OSV, Gitleaks and
  actionlint paths in real private PR jobs.

Changed

• Routed the consolidated private security bundle's pinned uv, actionlint,
  OSV-Scanner and gitleaks artifacts through the public immutable tool-cache
  action. Baked uv is reused without setup; GitHub-hosted and cache-miss jobs
  retain the same checksum-verified upstream fallback.
• Strengthened the consolidated private-free security bundle without adding a
  placement: actionlint logs plus Zizmor, OSV and fully redacted Gitleaks SARIF
  are always retained as a one-day artifact, including on aggregate failure.
• Completed the no-cancel invariant for queued work: every self-workflow and
  example now uses a run-id-unique concurrency group, because GitHub retains
  only one pending run in a shared group even when cancellation is false.
• Made preservation of started jobs a library invariant. All self-workflows and
  consumer examples now use cancel-in-progress: false; the executable
  workflow contract rejects future cancellation expressions, and the
  performance skills optimize duplicate work before execution instead of
  erasing in-flight evidence.
• Added opt-in preinstalled-toolchain paths to Go and Java CI. Immutable
  ephemeral runners verify exact baked Go/gofmt and Java/Maven commands and
  skip redundant setup-action downloads; hosted callers keep existing setup.
• Expanded python-ci.yml to an explicit uv-or-pip contract. Hosted callers
  receive the appropriate pinned setup action; immutable ephemeral callers may
  verify baked commands. pip fails closed without a project-owned install
  command instead of guessing dependency or lockfile policy.
• Expanded node-ci.yml from a Bun-only lane to a fail-closed npm, pnpm, Yarn
  and Bun contract. Hosted callers receive exact setup; immutable ephemeral
  callers can verify and reuse baked toolchains, avoiding repeated downloads.
  Empty install commands select each manager's frozen-lockfile default.