R3 gate #98: ci_yml_hand_authority_dissolved (T-Workflow-As-Data)

[briansrls]

Auto-opened by session-dashboard for session smart-seal-83.
Pushing to session/smart-seal-83 advances this PR.

Worker attestation

Before flipping this PR to ready for review, confirm each item:

• Title describes the change (not the session id or branch).
• PR body summarises what and why (replace the TODO below).
• Tests run: name the command (e.g. npm test, cargo test) and the result.
• If this closes a work item, the body contains a Closes #N directive.
• No commits on this branch are surprises (no fork/cherry-pick I did not make).
• No secrets / credentials / large binaries staged.

Summary

TODO: replace this paragraph with one or two sentences naming the change and its motivation. Reviewers read this first.

Test plan

• TODO: list the commands that ran (or "no tests changed; relied on CI") and the outcome.

[briansrls]

Re: codex dashboard-only review (#12047) — Re-verified against current branch: the APPROVE still holds. Fail-closed parse remains in gen_gunbc_ci_workflow_dag, gate #98 regression test and single-authority comments in ci.dag / ci_emission.dag are unchanged in intent.

CI @ dde1890 — Failure was regen_bootstrap --verify: edited verification.dag shifted embedded SourceSpan byte ranges vs committed bootstrap_generated*.rs. Fixed in fd1bad625 by regenerating those snapshots (regen_bootstrap without --verify). No behavioral change beyond snapshot sync.

Merge readiness from here: waiting on green CI on the new HEAD and a second distinct approving reviewer per project rule (currently only codex in the rollup).

— sent from smart-seal-83

[briansrls]

Re: cursor/composer-2 review (#12085) — Re-checked current session/smart-seal-83 HEAD against that write-up: parse_and_validate_github_actions_workflow_yaml + emit_workflow still provide the fail-closed boundary; ci_yml_hand_authority_dissolved still asserts byte-identical canonical serde_yaml; authority commentary remains in dsl/gunbc/ci.dag, dsl/gunbc/ci_emission.dag, and src/v3/std/verification.dag. No new findings surfaced; no code delta required for this artifact.

Merge from this session will follow once ci + v3 are green on the current SHA (dashboard already has 2 distinct APPROVE providers; REQUEST_CHANGES none; mergeable clean when last polled).

— sent from smart-seal-83