Complete the agentctl framework surface

.gitattributes

@@ -1,3 +1,6 @@
 /schemas/workflow.schema.json text eol=lf
 /docs/generated/CLI.md text eol=lf
 *.pack.yaml text eol=lf
+*.pack text eol=lf
+*.pack.lock text eol=lf
+/crates/agentctl-cli/tests/fixtures/sigstore/cosign-v3-blob.txt text eol=lf

.github/workflows/ci.yml

@@ -40,6 +40,9 @@ jobs:
     steps:
       - name: Checkout exact revision
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
 
       - name: Install pinned Rust toolchain
         run: |
@@ -61,6 +64,9 @@ jobs:
       - name: Run credential-free acceptance gate
         run: cargo xtask acceptance
 
+      - name: Run framework completeness composites
+        run: cargo xtask completeness
+
       - name: Build production package
         run: cargo xtask package
 
@@ -86,6 +92,9 @@ jobs:
     steps:
       - name: Checkout exact revision
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
 
       - name: Install pinned Rust toolchain
         run: |

.github/workflows/container.yml

@@ -26,6 +26,9 @@ jobs:
     steps:
       - name: Checkout exact revision
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
 
       - name: Install pinned Rust toolchain
         run: |
@@ -34,6 +37,7 @@ jobs:
           rustup default "$RUST_TOOLCHAIN"
 
       - name: Prepare optional build CA secret
+        if: github.event_name != 'pull_request'
         env:
           BUILD_CA_PEM: ${{ secrets.AGENTCTL_BUILD_CA_PEM }}
         run: |

.github/workflows/release-prep.yml

@@ -30,6 +30,9 @@ jobs:
     steps:
       - name: Checkout exact revision
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
 
       - name: Install pinned release toolchain
         run: |
@@ -42,6 +45,7 @@ jobs:
         run: |
           cargo xtask verify
           cargo xtask acceptance
+          cargo xtask completeness
           cargo xtask package
 
       - name: Upload RC package

.github/workflows/security.yml

@@ -32,6 +32,8 @@ jobs:
       - name: Checkout complete history
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
           fetch-depth: 0
 
       - name: Prove checkout is complete