fix(#2499): suppress false-positive version skew for independent GitHub Actions

[fullsend-ai-coder]

The cross-repo-contracts sub-agent flagged upload-artifact@v7 paired with download-artifact@v8 as an api-contract finding, warning about version skew. These actions are independently versioned in the actions/toolkit monorepo — different major versions are expected and artifact format compatibility is handled at the protocol level.

Added negative guidance to the cross-repo-contracts sub-agent prompt distinguishing independently versioned action pairs (upload/download- artifact) from tightly coupled pairs (cache/save + cache/restore). This suppresses the false positive while preserving the heuristic for genuinely coupled actions.

Note: pre-commit could not run (shellcheck-py failed to install in sandbox due to network restrictions). The post-script runs an authoritative pre-commit check on the runner.

---

Closes #2499

Post-script verification

• Branch is not main/master (agent/2499-actions-version-skew-fp)
• Secret scan passed (gitleaks — 6d271f01c289125bc260ac9a05f76a18a07be6f2..HEAD)
• Pre-commit hooks passed (authoritative run on runner)
• Tests ran inside sandbox

[github-actions]

E2E tests did not run

E2E tests run automatically for org/repo members and collaborators on pull requests.

For other contributors, a maintainer must add the ok-to-test label after the latest push.

See E2E testing guide for details.

[github-actions]

Site preview

Preview: https://83fafb4c-site.fullsend-ai.workers.dev

Commit: dfd5c96fa9a7adc0997c24d939840f58c086efbb

[rh-hemartin]

I think this is not needed, too specific.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 12:56 PM UTC · Completed 1:07 PM UTC
Commit: dfd5c96 · View workflow run →

[fullsend-ai-review]

Review skipped — this PR is already closed.

The /fs-review command only reviews open pull requests.

_{Posted by fullsend pre-review check}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 12:59 PM UTC · Completed 1:08 PM UTC
Commit: dfd5c96 · View workflow run →

[fullsend-ai-review]

Review skipped — this PR is already closed.

The /fs-review command only reviews open pull requests.

_{Posted by fullsend post-review check}

[fullsend-ai-retro]

Retro: PR #2500 (closed without merge)

What happened: The retro agent (from PR #2457) filed issue #2499 about a single false-positive review finding (version skew between upload-artifact@v7 and download-artifact@v8). The triage agent auto-labeled it ready-to-code, the code agent created PR #2500 adding a hardcoded allowlist to the cross-repo-contracts sub-agent prompt, and a human maintainer closed it ~4 minutes later as "not needed, too specific."

Assessment: The full retro→triage→code pipeline ran autonomously on a low-priority, single-instance false positive and produced work that was immediately rejected. The retro agent prescribed a narrow fix (hardcoding specific action pairs), the code agent implemented it faithfully, and the human correctly identified the approach as over-fitting. The biggest existing mitigation is #2314 (require human confirmation before auto-coding bot-created issues), which would have prevented the wasted code agent run.

Proposals: 1 new proposal filed (proportionality filter for retro proposals). Skipped proposing a triage gate — already covered by #2314.

Proposals filed

• Retro agent should assess fix proportionality before proposing changes for single-instance findings (in fullsend-ai/fullsend)