ci: tighten internal refs to @v1 and remove issue-feed shim (v1.1.0) (#68)

- Pin the notify workflows' internal octo-notify references @main -> @v1, so a
  @v1 caller gets a fully version-frozen graph (workflow + transport action),
  closing the v1.0.0 partial isolation leak.
- Remove the octo-issue-feed.yml back-compat shim (verified zero consumers
  org-wide; all callers now use octo-issue-notify.yml@v1).
- Docs §5 updated to mark the rename and internal-ref isolation resolved.

Author: lml2468

.github/workflows/octo-ci-status.yml

@@ -227,7 +227,7 @@ jobs:
 
       - name: Send to CI status feed
         if: steps.build.outputs.skip != 'true'
-        uses: Mininglamp-OSS/.github/.github/actions/octo-notify@main
+        uses: Mininglamp-OSS/.github/.github/actions/octo-notify@v1
         with:
           im-message: ${{ steps.build.outputs.im_message }}
           im-token: ${{ secrets.OCTO_BOT_TOKEN }}
@@ -238,7 +238,7 @@ jobs:
         # Run even if the ci-status send failed, so one IM group outage does not
         # suppress the other (matches the original "attempt both groups" behavior).
         if: ${{ always() && steps.build.outputs.skip != 'true' }}
-        uses: Mininglamp-OSS/.github/.github/actions/octo-notify@main
+        uses: Mininglamp-OSS/.github/.github/actions/octo-notify@v1
         with:
           im-message: ${{ steps.build.outputs.im_message }}
           im-token: ${{ secrets.OCTO_BOT_TOKEN }}

.github/workflows/octo-issue-feed.yml

@@ -16,9 +16,9 @@
 # secret. The agent fetches issue details itself via the GitHub API using
 # repo + number, so the body is NOT egressed through Actions.
 #
-# This is the canonical name. The legacy octo-issue-feed.yml is a thin
-# pass-through shim kept for callers not yet migrated; it will be removed after
-# all callers move to octo-issue-notify.yml@v1.
+# This is the canonical reusable for issue notification + triage. (It replaced
+# the legacy octo-issue-feed.yml, whose back-compat shim was removed in v1.1.0
+# once all callers migrated to octo-issue-notify.yml@v1.)
 name: Octo Issue Notify (reusable)
 
 on:
@@ -145,7 +145,7 @@ jobs:
 
       - name: Send (IM feed + optional triage webhook)
         if: steps.build.outputs.skip != 'true'
-        uses: Mininglamp-OSS/.github/.github/actions/octo-notify@main
+        uses: Mininglamp-OSS/.github/.github/actions/octo-notify@v1
         with:
           im-message: ${{ steps.build.outputs.im_message }}
           im-token: ${{ secrets.OCTO_BOT_TOKEN }}

.github/workflows/octo-issue-notify.yml

@@ -170,7 +170,7 @@ jobs:
 
       - name: Send to Octo IM
         if: steps.build.outputs.skip != 'true'
-        uses: Mininglamp-OSS/.github/.github/actions/octo-notify@main
+        uses: Mininglamp-OSS/.github/.github/actions/octo-notify@v1
         with:
           im-message: ${{ steps.build.outputs.im_message }}
           im-token: ${{ secrets.OCTO_BOT_TOKEN }}

.github/workflows/octo-pr-result-notify.yml

@@ -118,7 +118,7 @@ jobs:
 
       - name: Send to Octo IM
         if: steps.build.outputs.skip != 'true'
-        uses: Mininglamp-OSS/.github/.github/actions/octo-notify@main
+        uses: Mininglamp-OSS/.github/.github/actions/octo-notify@v1
         with:
           im-message: ${{ steps.build.outputs.im_message }}
           im-token: ${{ secrets.OCTO_BOT_TOKEN }}

.github/workflows/octo-pr-review-feed.yml

@@ -402,25 +402,23 @@ of them instantly, with no rollback anchor and no audit of which repo runs what.
    and creates/updates the GitHub Release on every `vX.Y.Z` tag push (stable
    releases only; pre-releases do not advance the alias).
 4. **Rename via shim**: `octo-issue-feed.yml` → `octo-issue-notify.yml` (canonical).
-   The old path is kept as a thin pass-through shim forwarding to the new name, so
-   callers migrate without a flag day; the shim is removed in a later `vX.Y.0`
-   once no caller references it.
+   During transition the old path was a thin pass-through shim. **Resolved in
+   v1.1.0**: all callers migrated to `octo-issue-notify.yml@v1`, the shim has zero
+   consumers and was removed.
 5. **Distribution = "both" model:**
    - **Enforced gates** (history-check, check-sprint, dependency-review,
      secret-scan, language quality) → org **required workflows / rulesets**, so
      no per-repo opt-in is needed. *This is what fixes the #65 failure mode.*
    - **Optional pieces** → `.github/workflow-templates/` starter workflows for
      one-click scaffolding of new repos, keeping callers uniform.
 
-**Known limitation — internal refs at v1.0.0 (tighten in v1.1.0):** the reusables'
-own internal `uses:` (the four notify workflows → `octo-notify@main`; the
-`octo-issue-feed` shim → `octo-issue-notify.yml@main`) stay `@main` in v1.0.0. A
-`@v1` caller therefore gets the frozen v1 *workflow* but a transitively-latest
-transport action — a partial isolation leak. They are NOT switched to `@v1` yet
-because the current `v1`/`#31` snapshot predates the `octo-notify` action (added
-in #66), so an internal `@v1` would resolve to a snapshot with no such action and
-break. Once `v1` is rolled onto a commit that contains `octo-notify` (this wave),
-a follow-up tightens internal refs to `@v1` and re-cuts `v1.1.0`.
+**Internal-ref isolation — RESOLVED in v1.1.0:** the reusables' own internal
+`uses:` (the notify workflows → `octo-notify`) now pin `@v1`, not `@main`. A
+`@v1` caller therefore gets a fully version-frozen graph (workflow *and* its
+transport action), closing the partial isolation leak that existed at v1.0.0.
+(They could not be `@v1` at v1.0.0 because the prior `v1`/#31 snapshot predated
+the `octo-notify` action from #66; once `v1` rolled onto a commit containing it,
+the refs were tightened and `v1.1.0` cut.)
 
 ---