fix: address sync review feedback

[stranske]

Summary

• expand agents guard event eligibility to cover all subscribed PR actions
• clarify the agent-event-eligibility custom predicate syntax and normalize non-Error detect-changes warnings
• harden state fingerprint API error handling and stabilize verifier diff hashing
• allow manifest-declared legacy agent workflow removals through the agents guard

Validation

• python -m black --check --target-version py312 scripts/state_fingerprint.py tests/scripts/test_state_fingerprint.py tests/workflows/test_agents_guard.py
• python -m pytest tests/scripts/test_state_fingerprint.py tests/workflows/test_agents_guard.py -q
• node --test .github/scripts/tests/detect-changes.test.js
• python scripts/validate_workflow_yaml.py .github/actions/agent-event-eligibility/action.yml .github/workflows/agents-guard.yml .github/workflows/agents-verifier.yml templates/consumer-repo/.github/workflows/agents-guard.yml templates/consumer-repo/.github/workflows/agents-verifier.yml
• git diff --check

Source fix for sync review feedback from stranske/Trend_Model_Project#5216.

[github-actions]

Workflow state fingerprint for Agents PR meta manager. Do not edit.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c8253fbc3e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Restrict allow-list entries to deletions only

Adding these paths to ALLOW_REMOVED_PATHS also exempts them from rename checks because evaluateGuard treats status === 'renamed' with removalAllowed as an unconditional continue (.github/scripts/agents-guard.js, rename branch). That means a PR can rename one of these newly allow-listed workflows (for example agents-autofix-loop.yml) into any other agents-*.yml path and bypass both the deletion block and the CODEOWNER/label approval gates, effectively introducing a protected workflow change without guard enforcement.

Useful? React with 👍 / 👎.

[agents-workflows-bot]

Automated Status Summary

Head SHA: 3cd2742
Latest Runs: ⏳ pending — Gate
Required contexts: Gate / gate, Health 45 Agents Guard / guard
Required: core tests (3.12): ⏳ pending, core tests (3.13): ⏳ pending, docker smoke: ⏳ pending, gate: ⏳ pending

Workflow / Job	Result	Logs
(no jobs reported)	⏳ pending	—

Coverage Overview

• Coverage history entries: 0

Failure triage

Detected failure types: pytest.

• error_type: pytest
  root_cause: Pytest reported failing tests.
  suggested_fix: Inspect failing tests in the reported files and fix the regression or update expectations.
  playbook_url: docs/INTEGRATION_GUIDE.md#scenario-1-tests-failing

Updated automatically; will refresh on subsequent CI/Docker completions.

---

Keepalive checklist

Scope

No scope information available

Tasks

• No tasks defined

Acceptance criteria

• No acceptance criteria defined

[github-actions]

No description provided.

[Copilot]

Pull request overview

This PR tightens several agent/workflow follow-up behaviors after sync review feedback: it broadens event eligibility for the agents guard, hardens state-fingerprint/API error handling, and makes verifier diff hashing more deterministic. It also updates guard exceptions for legacy workflow removals and adds regression tests around the new behavior.

Changes:

• Expanded agents guard eligibility/triggers and allowed additional legacy workflow deletions.
• Hardened state_fingerprint.py network/JSON error handling and added repo-variable/error-path tests.
• Stabilized verifier diff hashing and normalized non-Error warnings in detect-changes.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tests/workflows/test_agents_guard.py	Adds guard coverage for newly allowed workflow deletions.
tests/scripts/test_state_fingerprint.py	Adds regression tests for repo-variable storage and API/error handling.
templates/consumer-repo/.github/workflows/agents-verifier.yml	Mirrors verifier diff-hash stabilization in the consumer template.
templates/consumer-repo/.github/workflows/agents-guard.yml	Mirrors expanded guard event eligibility in the consumer template.
templates/consumer-repo/.github/scripts/detect-changes.js	Mirrors safer warning formatting for non-Error failures.
templates/consumer-repo/.github/scripts/agents-guard.js	Mirrors added guard deletion exceptions for legacy workflows.
scripts/state_fingerprint.py	Wraps more API failure modes and broadens top-level exception handling.
.github/workflows/agents-verifier.yml	Sorts diff surface before hashing for stable verifier fingerprints.
.github/workflows/agents-guard.yml	Expands allowed PR actions checked by event eligibility.
.github/scripts/detect-changes.js	Preserves warning text when wrapper init throws non-Error values.
.github/scripts/agents-guard.js	Expands removal allow-list for legacy agent workflows.
.github/scripts/__tests__/detect-changes.test.js	Adds regression coverage for non-Error wrapper failures.
.github/actions/agent-event-eligibility/action.yml	Clarifies action input descriptions and custom-predicate syntax.