merge: 1.6.26-implementation into main

Author: bobaikato

.github/workflows/codeql.yml

@@ -52,12 +52,12 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@v4.37.3
         with:
           languages: rust
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v4
+        uses: github/codeql-action/autobuild@v4.37.3
 
       - name: Analyze
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@v4.37.3

.github/workflows/ota-readiness.yml

@@ -59,7 +59,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
       - name: Install ota from contract truth
-        uses: ota-run/setup@v1
+        uses: ota-run/setup@v1.0.8
         with:
           source: contract
       - name: Prepare ota repo readiness path

AGENTS.md

@@ -55,6 +55,12 @@ work complete:
 Update each surface that is affected. If one is not affected, state that decision in the handoff or
 completion summary; do not silently assume core code alone is enough.
 
+**Command-reference gate:** every public CLI command or subcommand addition, removal, rename, flag
+surface, or semantic change must update both `docs/spec/command-reference.md` and the rendered
+site command index at `/docs/reference/command` in `ota-site`. The Core Markdown specification is
+not sufficient when the site uses curated command cards. Run the site command-reference sync check
+and confirm the local rendered page exposes the command before declaring propagation complete.
+
 Pressure testing is product discovery as well as proof. Follow the canonical Ota skill's
 `references/pressure-testing-protocol.md` from `/Users/bobai/Workspace/Ota.run/skills` when it is
 available locally. Every pressure repo must prove the advertised task, workflow, runtime, mode,