feat(autocurrency): add agent-driven currency fix loop

[Eren-Jeager123]

Summary

Add an automated agent that diagnoses and fixes CI failures on auto-update PRs (vLLM/SGLang currency bumps).

What This PR Adds

File	Purpose
.github/workflows/agent-currency-fix.yml	Workflow triggered by workflow_run when PR CI fails on auto-update/* branches
scripts/autocurrency/agent-fix.py	Python script that reads CI logs, calls Bedrock Claude Opus 4.6, and applies file edits

How It Works

PR CI fails → workflow_run fires → validate branch name (regex)
→ checkout main (trusted) → copy agent-fix.py to /tmp
→ git switch to PR branch → count [agent-fix] commits
→ if < 3: call Bedrock → parse search/replace blocks → apply with fuzzy match
  → if apply fails: retry LLM with error context (up to 3 retries)
  → if apply succeeds: commit → push → PR CI re-runs
→ if >= 3: comment on PR, escalate to human

Edit Format: Search/Replace Blocks (Industry Standard)

Uses the same format as Aider, Cline, and Claude's native editing:

docker/vllm/Dockerfile
<<<<<<< SEARCH
  "pillow>=11.0.0" \
  "xgrammar>=0.1.30" \
=======
  "pillow>=12.1.1" \
  "xgrammar>=0.1.32" \
>>>>>>> REPLACE

Why this format: Claude is trained on it, avoids line numbers (LLMs can't count), clear delimiters, industry convergence.

Matching (3 layers): exact → whitespace-normalized → fuzzy (difflib >= 0.8)

Retry loop: If edits fail to apply or response is unparseable, retries up to 3 times with error feedback showing what the file actually contains (same approach as Aider).

Security Architecture

CodeQL compliant:

• actions/checkout only checks out main (trusted, default branch)
• PR branch switched via git fetch + git checkout (not actions/checkout)
• agent-fix.py always executed from main's copy (/tmp/agent-fix.py)
• Branch name validated against strict regex ^auto-update/[a-z]+-[0-9]+\.[0-9]+\.[0-9]+$
• All event data stored in env vars (no direct ${{ }} interpolation in run: blocks)
• No actions/cache usage (avoids cache poisoning)
• Push explicitly targets HEAD:$HEAD_BRANCH

Loop Prevention

Two levels:

1. Outer loop (across CI cycles): Git commit counting — max 3 [agent-fix] commits per PR branch
2. Inner loop (within one workflow run): LLM retry — max 3 Bedrock calls if response is unparseable or edits fail to apply

Key Design Decisions

1. Trigger: workflow_run + startsWith(branch, 'auto-update/') — branch name over PR label (payload doesn't include labels)
2. Edit format: Search/replace blocks — industry standard, highest LLM accuracy, fuzzy matching fallback
3. Scope: Ubuntu variants only (PR - vLLM EC2/SageMaker, PR - SGLang EC2/SageMaker). Expand after testing.
4. Concurrency: One agent per branch (cancel-in-progress: true). Multiple failing workflows → last one wins.
5. Safety: Independent workflow, not a required check, cannot merge, human approval required.

Dependencies

• IAM change: Adds bedrock:InvokeModel permission to CodeBuild runner role (separate infra PR)

Testing

• workflow_run can only trigger from the default branch — cannot test from feature branch
• Risk is zero: independent workflow, cannot impact PR merge status
• Will validate on the next real auto-update PR failure