2026-04-08 Daily Audit

[NWarila]

Summary

• refresh the dogfood .github/scripts copy to the released �1.0.4 set, including sync.py
• tighten reusable workflow and template CI permissions so only the coverage publish job has contents: write
• pin overlapping dev-tool dependencies in root and reference pyproject.toml to the same versions used by pre-commit hooks

Audit notes

• Open PR backlog on 2026-04-08: none
• Latest verified Template CI main-branch run: 24152483904 (all jobs green; tests succeeded on ubuntu-latest, windows-latest, and macos-latest)
• Latest verified Auto Release run: 24151035753 (success)
• Self Update remains blocked for live validation in this session because authenticated workflow dispatch / PR automation access is unavailable here

Local validation

• .venv\Scripts\python.exe scripts\qa.py
• .venv\Scripts\python.exe .github\scripts\qa.py --skip lint --skip types --skip tests --skip security --skip spelling --skip package

Remaining blockers

• GitHub CLI auth in this environment is invalid, so any follow-up API-driven PR updates / manual workflow dispatches may require re-authentication outside this session