Pin stable Docs Agent provenance

[chubes4]

Summary

• pin Docs Agent d1bf3241 with stable package and validator provenance
• pin WP Codebox 0227ca75 for diagnosable verification failures
• preserve the Figma diagnostics, bootstrap, and skills source contracts

How to test

1. Run pnpm install --frozen-lockfile.
2. Check out Docs Agent d1bf324154b4604099ae3209f64519386caf1f48 and WP Codebox 0227ca7551d8cd98f14242b31e142b50f78dff13.
3. Run DOCS_AGENT_DIR=/path/to/docs-agent WP_CODEBOX_DIR=/path/to/wp-codebox pnpm test.
4. Run actionlint .github/workflows/*.yml.

Compatibility

This updates immutable workflow provenance only. Generated plugin behavior and workflow source contracts are unchanged.

Depends on Automattic/docs-agent#170

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode with GPT-5.6-sol
• Used for: Updated producer provenance and contract assertions with Chris reviewing and owning the change.