chore: cherry-pick upstream Tier 6 workflow polish (7 commits) — batch 7

[prospapledge88]

Summary

Cherry-picks 7 workflow-polish commits (Tier 6) from coleam00/archon upstream/dev. Builds on PRs #6/#7/#8/#9/#10/#11; cumulative absorption now 57 / 110 upstream commits.

Picks (chronological)

Upstream	Description
817186d4	Make archon-adversarial-dev init sed portable on macOS (no sed -i) (coleam00#1155)
46671c46	Filter user-plugin MCP failure noise out of workflow warnings (coleam00#1327)
d1a7c96f	Test coverage for anyFailed status derivation in DAG executor (coleam00#1403)
3a291b48	Migrate archon-piv-loop plan handoff to $ARTIFACTS_DIR/progress.txt (coleam00#1398)
87234c0b	Switch eight bundled-workflow Opus pins from claude-opus-4-5-20250929 to opus[1m] alias (coleam00#1395)
f342d059	Fix approval gate state-machine bypass after reject-with-redraft on resume (coleam00#1435)
dc83efb2	Concise failure messages for bash/script nodes (coleam00#1389, coleam00#1393)

Skipped / already-absorbed

• 4c6ddd99 (fail loudly on SDK isError) — already absorbed in earlier batch
• 7ea32141 (initialize options.hooks before YAML merge) — already absorbed
• bc25deef (detect completion in any XML tag) — already absorbed
• f094f2ad was applied but partially: the path migration was already covered by the fork's prior 8295ece7 resolution, so the net diff to archon-piv-loop.yaml is small.

Pre-existing fork conflict markers cleaned up

.archon/workflows/defaults/archon-piv-loop.yaml had two unresolved <<<<<<< HEAD ... 8295ece7 conflict markers committed to dev that survived from an earlier cherry-pick. They surfaced again as nested conflicts during this batch and have now been resolved in favor of the safer 8295ece7 version (explicit git add path/... instead of git add -A, plus the Never stage guidance). The two markers should never have been committed in the first place — flagging here so you're aware. Section diff after resolution:

• Step 4 (Phase 3 commit guidance): now reads **Never stage**: ... or anything under $ARTIFACTS_DIR.\n\nTrack progress in $ARTIFACTS_DIR/progress.txt:
• Step 5 (post-validation fixes): now uses explicit git add path/to/file1 ... + git status --porcelain + git diff --cached --quiet || git commit ... (was git add -A && git commit ... 2>/dev/null || true)

Conflict-resolution notes

• packages/workflows/src/dag-executor.ts (6fea3926) — fork imports join from path, upstream adds isAbsolute and resolve as resolvePath. Combined: import { isAbsolute, join, resolve as resolvePath } from 'path'.
• packages/workflows/src/dag-executor.test.ts (6fea3926) — fork's shouldContinueStreamingForStatus describe block conflicted with upstream's three new MCP-filter describe blocks. Resolution: kept fork's existing block (terminated cleanly with });), then appended the upstream parseMcpFailureServerNames, loadConfiguredMcpServerNames, and executeDagWorkflow -- MCP failure filtering describes.
• packages/workflows/src/dag-executor.test.ts (a57d6281) — upstream's added block tried to also re-add shouldContinueStreamingForStatus (fork already has it from an earlier batch). Resolution: dropped the duplicate, kept the new executeDagWorkflow -- final status derivation describe.
• .archon/workflows/defaults/archon-piv-loop.yaml (f094f2ad) — see pre-existing conflict markers above.
• packages/workflows/src/defaults/bundled-defaults.generated.ts — auto-merge conflicts from every YAML touch were resolved by taking upstream's bytes during the picks, then re-running bun run generate:bundled at the end so the file matches the fork's actual default set. Final regen lands as a separate commit (b9bb2860).
• packages/docs-web/src/content/docs/guides/script-nodes.md (fccfe423) — upstream wants to modify the file, but the fork hasn't absorbed 46874cab which creates it. Dropped the docs change rather than create a half-merged docs page.
• CHANGELOG.md (multiple picks) — git checkout --ours for each conflict, then a single batched entry added at the end.

Validation

bun run validate passes (with the same baseline-equivalent test failures as dev):

• check:bundled ✅ (36 commands, 22 workflows up to date — 22 because the regen consolidates Opus pins)
• check:bundled-skill ✅ (21 files match)
• type-check ✅ (all 10 packages)
• lint ✅ (zero warnings)
• format:check ✅
• test baseline-equivalent on macOS local: 25 fail in @archon/core + 1 fail in @archon/workflows (script-node .env leak — macOS-specific; doesn't fire on Linux CI). Linux CI is expected to show the alternative baseline 25 + 2 fail in @archon/workflows (substituteWorkflowVariables prefix tests pre-dating the prompt-injection sanitizer wrap), per the saved memory documenting the platform split. Net: baseline-equivalent on both platforms. New: the 7 cherry-picks together add ~25 new tests (mostly in dag-executor.test.ts), all passing.

Test plan

• bun run validate clean (baseline-equivalent failures, same as dev)
• All 7 picks applied (3 already-absorbed picks dropped cleanly)
• Pre-existing archon-piv-loop.yaml conflict markers resolved
• Bundled defaults regenerated after Opus alias + sed fix + piv-loop migration
• CI green on push
• Post-merge spot-check: trigger an approval-gate workflow with reject + redraft + resume; verify the redraft prompt re-runs (not a silent approve)

🤖 Generated with Claude Code