fix(ci): disarm the Inbox Steward notification amplifier (#451)

`check_suite:[completed]` and `workflow_run:[completed]` made this fire
**once per CI completion** on every watched workflow — the mechanism
behind the 2026-07-20/21 notification burst (**3,041 CheckSuite
notifications in a ~19-hour window**, none since).

The workflow is `disabled_manually` today, which is why it stopped. That
makes the risk **latent, not resolved** — these triggers plus `contents:
write`/`pull-requests: write` mean re-enabling restarts the multiplier.

Removed so that re-enabling is safe. `pull_request`,
`pull_request_review` and `workflow_dispatch` retained.

**Verified:** YAML parses; trigger map is now exactly `pull_request,
pull_request_review, workflow_dispatch`.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/dogfood-gate.yml

@@ -43,7 +43,7 @@ jobs:
 
       - name: Validate A2ML manifests
         if: steps.detect.outputs.count > 0
-        uses: hyperpolymath/a2ml-validate-action@05bcb78917c09702e90ed18004298a6728753914 # main
+        uses: hyperpolymath/a2ml-ecosystem/validate-action@aa4b836bd969df2bc58128cb8e3d20bbc88d5e79 # main
         with:
           path: '.'
           strict: 'false'
@@ -105,7 +105,7 @@ jobs:
 
       - name: Validate K9 contracts
         if: steps.detect.outputs.k9_count > 0
-        uses: hyperpolymath/k9-validate-action@bddcd9109ee96f9ea3fdb4bf51084fe9cd0909ce # main
+        uses: hyperpolymath/k9-ecosystem/validate-action@89f3c2702f4f650a92aa7411502f38da06abd562 # main
         with:
           path: '.'
           strict: 'false'

.github/workflows/inbox-steward.yml

@@ -21,15 +21,12 @@ on:
     types: [opened, synchronize, ready_for_review, converted_to_draft, review_requested]
   pull_request_review:
     types: [submitted, dismissed]
-  check_suite:
-    types: [completed]
-  workflow_run:
-    workflows: 
-      - Dogfood Gate
-      - Scorecard Enforcer
-      - Hypatia Security Scan
-      - Static Analysis Gate
-    types: [completed]
+  # AMPLIFIER REMOVED 2026-07-29. check_suite:[completed] and
+  # workflow_run:[completed] made this fire once per CI completion on every
+  # watched workflow -- a multiplier on every unit of estate CI activity, and
+  # the mechanism behind the 3,041-notification burst of 2026-07-20/21.
+  # The workflow is currently disabled_manually; these triggers are removed so
+  # that RE-ENABLING it is safe. PR/review events and workflow_dispatch remain.
   # Manual trigger
   workflow_dispatch:
     inputs:
@@ -430,6 +427,7 @@ jobs:
   summary:
     name: Generate stewardship summary
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     needs: [identify-passed-prs, validate-prs, auto-merge-prs]
     if: always()
 

.github/workflows/push-email-notify.yml

@@ -13,6 +13,7 @@ jobs:
     name: Email on push
     if: ${{ vars.PUSH_EMAIL_ENABLED == 'true' }}
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Send push notification email
         uses: dawidd6/action-send-mail@c50dc4cc848ade21f848990889906d804fae78c5 # pinned

.machine_readable/AGENTIC.a2ml .machine_readable/6a2/AGENTIC.a2ml.machine_readable/AGENTIC.a2ml renamed to .machine_readable/6a2/AGENTIC.a2ml

@@ -10,6 +10,21 @@ use crate::analyzers::Analyzer;
 use crate::fleet::{Finding, ImpactAssessment, Severity, WcagLevel};
 use regex::Regex;
 use std::path::Path;
+use std::sync::LazyLock;
+
+// Compiled once. These were rebuilt on every call (hypatia expect_in_hot_path).
+static COLOR_RE: LazyLock<Regex> =
+    LazyLock::new(|| Regex::new(r"(?i)(?:^|;|\{)\s*color\s*:\s*([^;}\n]+)").expect("valid regex"));
+static BG_RE: LazyLock<Regex> =
+    LazyLock::new(|| Regex::new(r"(?i)background(?:-color)?\s*:\s*([^;}\n]+)").expect("valid regex"));
+static BLOCK_RE: LazyLock<Regex> =
+    LazyLock::new(|| Regex::new(r"([^{]+)\{([^}]+)\}").expect("valid regex"));
+static STYLE_RE: LazyLock<Regex> =
+    LazyLock::new(|| Regex::new(r#"style\s*=\s*"([^"]+)""#).expect("valid regex"));
+static COLOR_RE_4: LazyLock<Regex> =
+    LazyLock::new(|| Regex::new(r"(?i)(?:^|;)\s*color\s*:\s*([^;]+)").expect("valid regex"));
+static BG_RE_5: LazyLock<Regex> =
+    LazyLock::new(|| Regex::new(r"(?i)background(?:-color)?\s*:\s*([^;]+)").expect("valid regex"));
 
 /// Contrast analyzer for CSS color pairs
 pub struct ContrastAnalyzer;
@@ -133,15 +148,11 @@ pub fn contrast_ratio(fg: (u8, u8, u8), bg: (u8, u8, u8)) -> f64 {
 /// Analyze CSS content for contrast issues
 fn analyze_css(path: &Path, content: &str) -> Vec<Finding> {
     let mut findings = Vec::new();
-    let color_re = Regex::new(
-        r"(?i)(?:^|;|\{)\s*color\s*:\s*([^;}\n]+)"
-    ).expect("valid regex");
-    let bg_re = Regex::new(
-        r"(?i)background(?:-color)?\s*:\s*([^;}\n]+)"
-    ).expect("valid regex");
+    let color_re = &*COLOR_RE;
+    let bg_re = &*BG_RE;
 
     // Extract color/background-color pairs within CSS rule blocks
-    let block_re = Regex::new(r"([^{]+)\{([^}]+)\}").expect("valid regex");
+    let block_re = &*BLOCK_RE;
 
     for caps in block_re.captures_iter(content) {
         let selector = caps[1].trim();
@@ -211,9 +222,9 @@ fn analyze_css(path: &Path, content: &str) -> Vec<Finding> {
 /// Analyze inline styles in HTML for contrast issues
 fn analyze_inline_styles(path: &Path, content: &str) -> Vec<Finding> {
     let mut findings = Vec::new();
-    let style_re = Regex::new(r#"style\s*=\s*"([^"]+)""#).expect("valid regex");
-    let color_re = Regex::new(r"(?i)(?:^|;)\s*color\s*:\s*([^;]+)").expect("valid regex");
-    let bg_re = Regex::new(r"(?i)background(?:-color)?\s*:\s*([^;]+)").expect("valid regex");
+    let style_re = &*STYLE_RE;
+    let color_re = &*COLOR_RE_4;
+    let bg_re = &*BG_RE_5;
 
     for (line_num, line) in content.lines().enumerate() {
         if let Some(style_caps) = style_re.captures(line) {