chore(actions): pin to @main + add diagnostic to checkout action — chase ext-tools 404

The "external-tools.json not found" error fires from both the
checkout and setup composite actions. fce50ac added a diagnostic
ls to setup/action.yml; this commit adds the same to
checkout/action.yml so both lookup paths print their runtime
GITHUB_ACTION_PATH state.

To get the diagnostic to actually FIRE on the next CI run,
the workflow needs to invoke action versions that include
the diagnostic. The SHA pins in the fleet point at OLD
versions (no diagnostic). Temporarily pin
`_local-not-for-reuse-ci.yml`'s setup-and-install to @main,
and the inner setup-and-install/action.yml's checkout +
setup pins to @main, so the next push lands the diagnostic
code in CI. Will revert to SHA pins once the path-resolution
issue is fixed.

Pre-commit lint/test bypassed via DISABLE_PRECOMMIT_* —
local SOCKET_API_KEY in a 401 state. User-authorized via
'Allow lint bypass'.

Author: jdalton

.github/actions/checkout/action.yml

@@ -53,6 +53,17 @@ runs:
         if [ ! -f "$TOOLS_FILE" ]; then
           echo "× socket-registry checkout action is broken: external-tools.json not found at ${TOOLS_FILE}." >&2
           echo "  This is a packaging bug in SocketDev/socket-registry, not a consumer issue. File a bug." >&2
+          echo "" >&2
+          echo "  Diagnostics — what's actually present at runtime:" >&2
+          echo "    GITHUB_ACTION_PATH=${GITHUB_ACTION_PATH}" >&2
+          echo "    ls -la \"\${GITHUB_ACTION_PATH}\":" >&2
+          ls -la "${GITHUB_ACTION_PATH}" 2>&1 | sed 's/^/      /' >&2 || true
+          echo "    ls -la \"\${GITHUB_ACTION_PATH}/..\" (parent — should be .github/actions/):" >&2
+          ls -la "${GITHUB_ACTION_PATH}/.." 2>&1 | sed 's/^/      /' >&2 || true
+          echo "    ls -la \"\${GITHUB_ACTION_PATH}/../..\" (grandparent — should be .github/):" >&2
+          ls -la "${GITHUB_ACTION_PATH}/../.." 2>&1 | sed 's/^/      /' >&2 || true
+          echo "    ls -la \"\${GITHUB_ACTION_PATH}/../../..\" (great-grandparent — should be repo root):" >&2
+          ls -la "${GITHUB_ACTION_PATH}/../../.." 2>&1 | sed 's/^/      /' >&2 || true
           exit 1
         fi
         # Read JSON values via lib/jq.mjs. See setup/action.yml for

.github/actions/setup-and-install/action.yml

@@ -71,14 +71,14 @@ runs:
   steps:
     - name: Checkout
       if: inputs.checkout == 'true'
-      uses: SocketDev/socket-registry/.github/actions/checkout@64eb126e90301045eb095cf18f8050db3ff358a2 # main (2026-05-15)
+      uses: SocketDev/socket-registry/.github/actions/checkout@main # diagnostic (2026-05-18)
       with:
         fetch-depth: ${{ inputs.checkout-fetch-depth }}
         ref: ${{ inputs.checkout-ref }}
         working-directory: ${{ inputs.working-directory }}
 
     - name: Setup environment
-      uses: SocketDev/socket-registry/.github/actions/setup@60ba2612776f9d9c6d63fb24fdac4cd9991e505d # main (2026-05-15)
+      uses: SocketDev/socket-registry/.github/actions/setup@main # diagnostic (2026-05-18)
       with:
         debug: ${{ inputs.debug }}
         node-version: ${{ inputs.node-version }}

.github/workflows/_local-not-for-reuse-ci.yml

@@ -30,7 +30,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@56be73d6881212e642f35a3cd165e27cb1c09aef # main (2026-05-15)
+      # TEMPORARY: pin to `main` instead of a SHA so the diagnostic
+      # `ls -la` block added in setup/action.yml + checkout/action.yml
+      # actually runs (the old SHA-pinned setup-and-install@56be73d6
+      # doesn't have the diagnostic yet). Revert to a stable SHA
+      # once external-tools.json path resolution is fixed.
+      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@main # diagnostic (2026-05-18)
         with:
           node-version: 22