Use proof-pr v0.2.0 workflow

[saagpatel]

What

Updates the advisory proof-pr dogfood workflow to consume proof-pr v0.2.0.

Why

proof-pr v0.2.0 models committed receipt SHA anchoring with subject.head_sha_status, so the existing dogfood receipt needs the new metadata before the v0.2 reusable workflow can validate it.

Review Of What Was Built

• Updated .github/workflows/proof-pr.yml from v0.1.3 to v0.2.0.
• Added subject.head_sha_status: pending_commit to the committed proof-pr.json receipt.

Cleanup Review

No application code, generated portfolio truth, release workflows, or private proof package content changed.

Verification Summary

Proof Bundle

Risk: T3
Receipt: proof-pr.v1 for dc78a6d1c5817359fbf4593c92dbbcb47e77afd2
Decision: ready_with_operator_awareness

Evidence:

• workflow-yaml: ruby -e "require 'yaml'; YAML.load_file('.github/workflows/proof-pr.yml')" -> passed (workflow YAML parses.)
• receipt-validation: PYTHONDONTWRITEBYTECODE=1 python3 /Users/d/Projects/proof-pr/scripts/proof_pr.py validate proof-pr.json -> passed (committed receipt validates with proof-pr v0.2.0 rules.)
• render-anchor: PYTHONDONTWRITEBYTECODE=1 python3 /Users/d/Projects/proof-pr/scripts/proof_pr.py render proof-pr.json --head-sha 3473e5bd6ff3bf206f27c76c6f1fa0e5a8712e13 -> passed (pending-commit anchor renders cleanly.)
• diff-check: git diff --check -> passed.
• secrets: gitleaks detect --source . --no-banner --redact --verbose -> passed (no leaks found.)
• github-pr-checks: gh pr checks 89 -R saagpatel/GithubRepoAuditor --watch --interval 10 -> passed (CodeQL and test (3.11) passed.)
• rollback: documented (revert this PR or restore workflow refs to v0.1.3 and remove head_sha_status if rolling back format compatibility.)

Known gaps:

• Manual workflow dispatch should be run after merge to prove v0.2.0 consumption on main.

Shipped Summary

If merged, GithubRepoAuditor will consume the released v0.2.0 proof-pr workflow and its committed receipt will validate under the new pending-commit SHA rule.

Next Phase

Run the manual proof-pr workflow from main after merge and confirm it uploads github-repo-auditor-proof-pr.

Remaining Roadmap

• Keep pull_request enforcement deferred until dogfood remains boring.
• Update future committed receipts to include head_sha_status when they use placeholder heads.