Pin stable Docs Agent provenance

[chubes4]

Summary

• pin Docs Agent d1bf3241 with stable package and validator provenance
• pin WP Codebox 0227ca75 for diagnosable verification failures
• keep the workflow-run-awaiter source delta unchanged

How to test

1. Check out Docs Agent d1bf324154b4604099ae3209f64519386caf1f48 and WP Codebox 0227ca7551d8cd98f14242b31e142b50f78dff13.
2. Run DOCS_AGENT_DIR=/path/to/docs-agent WP_CODEBOX_DIR=/path/to/wp-codebox php tests/docs-agent-native-workflow-contract.php.
3. Run actionlint .github/workflows/*.yml.

Compatibility

This updates immutable workflow provenance only. Runtime APIs and the bounded source delta are unchanged.

Depends on Automattic/docs-agent#170

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode with GPT-5.6-sol
• Used for: Updated producer provenance and contract assertions with Chris reviewing and owning the change.