fix: align agents guard fallback pin

[stranske]

Summary

• align the Workflows root agents-guard setup-api-client fallback pin with the current consumer template pin
• refresh the agents-guard template drift allowlist fingerprint and reason

Validation

• python3 scripts/validate_template_sync.py
• python3 scripts/validate_template_completeness.py
• python3 scripts/check_template_drift.py --allowlist config/template-drift-allowlist.txt
• git diff --check

Part of the sync/dependency cleanup campaign; unblocks generated sync PR review debt.

Summary by CodeRabbit

• Chores
  • Updated an automation workflow reference to a newer, fixed version for more consistent runs.
  • Refreshed the related allowlist entry to match the latest approved workflow state.

[stranske-keepalive]

Workflow source needed

PR #2540 needs either a linked GitHub issue or one valid non-issue Workflow Source before PR metadata automation can manage it safely.

Please do one of:

• Add <!-- meta:issue:123 --> or a normal Closes #123 / Related to #123 line.
• Check one Workflow Source option in the PR body.
• Add a hidden marker such as <!-- workflow-source:local_request -->, <!-- workflow-source:manual_remote -->, <!-- workflow-source:review_followup -->, <!-- workflow-source:sync_campaign -->, or <!-- workflow-source:dependabot -->.
• Add a workflow source label such as workflow:source-direct-pr, workflow:source-local-request, workflow:source-review-followup, workflow:source-sync, or workflow:no-automation.

Once a valid source is present, this warning will not be reposted.

[stranske-keepalive]

Automated Status Summary

Head SHA: 676e60f
Latest Runs: ⏳ pending — Gate
Required contexts: Gate / gate, Health 45 Agents Guard / guard
Required: core tests (3.12): ⏳ pending, core tests (3.13): ⏳ pending, docker smoke: ⏳ pending, gate: ⏳ pending

Workflow / Job	Result	Logs
(no jobs reported)	⏳ pending	—

Coverage Overview

• Coverage history entries: 0

Updated automatically; will refresh on subsequent CI/Docker completions.

---

Keepalive checklist

Scope

No scope information available

Tasks

• No tasks defined

Acceptance criteria

• No acceptance criteria defined

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 8eca0716-8bb6-44e7-9e97-ed92fb6a4229

📥 Commits

Reviewing files that changed from the base of the PR and between cd5687d and 46683f4.

📒 Files selected for processing (2)

• .github/workflows/agents-guard.yml
• config/template-drift-allowlist.txt

---

📝 Walkthrough

Walkthrough

The workflow updates the fallback setup-api-client pin for both pull_request_target and pull_request. The matching template-drift allowlist entry updates its main_sha256 and reason text, while template_sha256 stays unchanged.

Changes

Workflow fallback pin refresh

Layer / File(s)	Summary
Workflow pin update .github/workflows/agents-guard.yml	Both fallback setup-api-client steps now reference the new pinned commit SHA.
Allowlist update config/template-drift-allowlist.txt	pair.10 updates main_sha256 and the reason text to match the refreshed fallback pin; template_sha256 is unchanged.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Possibly related PRs

• stranske/Workflows#2539: Updates the same agents-guard.yml fallback pin from 6c3391... to a525e6... for both events.
• stranske/Workflows#2522: Also updates the setup-api-client fallback pin and the corresponding pair.10 allowlist entry.
• stranske/Workflows#2471: Touches the same workflow/action pin plus the matching template-drift allowlist entry.

Suggested labels

dependencies

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/align-agents-guard-fallback-pin

---

_{Comment @coderabbitai help to get the list of available commands.}