Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/actions/install-aicr-release/action.yml:
- Around line 52-90: The provenance check is too broad because identity_re
allows any refs/tags/*, so a binary attested for one tag could be accepted for a
different release tag. Tighten the verification in the install flow by matching
the exact requested tag in the certificate SAN, using the release tag value
already available in the action and the cosign verify-blob-attestation call.
Update the identity_re construction and any related tag handling so the
attestation must correspond to the specific release being installed, not just
any tag in the repo.

In @.github/workflows/uat-nightly-batch.yaml:
- Around line 166-177: The run lookup in the nightly workflow is relying on a
shared displayTitle plus createdAt filtering, which can match the wrong
dispatch. Thread a unique correlation token from the controller into
uat-run.yaml and use that token to identify the target run in the gh run list/jq
resolution logic instead of matching only the UAT <reservation> @ <version>
title; update the resolver around the run_id lookup to key off the unique token.
- Around line 180-183: The dispatch loop in the uat-nightly-batch workflow
should stop advancing when a job is dispatched but its run id cannot be
resolved, because continuing breaks the intended sequential ordering. In the
block that checks for an empty run_id, change the control flow in the
dispatch/wait logic to fail fast or otherwise halt the remaining dispatches
instead of using continue, so later cells cannot supersede the unresolved one.
Use the run_id resolution check in the workflow step as the unique anchor for
the fix.

In @.github/workflows/uat-run.yaml:
- Around line 17-20: The run-name in uat-run.yaml is not unique enough for
controller correlation because the same UAT title can be reused across retries
and dispatches. Update the workflow’s run-name to include a controller-supplied
nonce input alongside reservation and version, and ensure the nightly driver
passes a unique value such as a controller run id plus cell index. Use the
existing workflow dispatch inputs and the run-name field together so each
dispatched run can be matched unambiguously.

In `@docs/contributor/uat.md`:
- Line 51: The UAT example in the contributor docs is incomplete because it
omits the repository and ref, which can make copy-pasted commands fail or run
the wrong workflow revision. Update the command in the affected markdown section
to use the fully qualified gh workflow run invocation with the same repo and ref
context as the nightly path, so readers can run it reliably outside a clone or
from any branch.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/uat-aws.yaml:
- Around line 117-145: The workflow still runs Setup Go unconditionally, which
keeps release cells dependent on the source toolchain even though they should
use the released binary path. Update the uat-aws workflow so the Setup Go step
is guarded the same way as Build aicr binary, using inputs.aicr_version == ''
(and skip_tests as applicable), or move Setup Go into the main-cell-only path
alongside the Build aicr binary step. Keep the release-only flow around
install-aicr-release and the existing Build and push validator images gating
consistent with this split.

In @.github/workflows/uat-gcp.yaml:
- Around line 115-143: Keep release cells independent of the source Go toolchain
by updating the workflow so the existing Setup Go step is only executed for main
cells, not when inputs.aicr_version is set. Reuse the same condition pattern
already used by Build aicr binary and Build and push validator images, and
ensure install-aicr-release remains the only path for release cells so a broken
Go pin cannot block them before the released binary is installed.

In @.github/workflows/uat-nightly-batch.yaml:
- Around line 129-136: Anchor the nightly batch deadline to a single batch-wide
timestamp instead of recomputing it per matrix leg. Update the workflow in the
UAT nightly batch job so the step that derives `deadline` uses a shared batch
start value captured once for the whole run, then reuse that value across all
matrix entries in the logic around `PREVIOUS_N` and `DEADLINE_OFFSET_HOURS`.
Make the same change in the duplicated section referenced by the comment so
every reservation leg stops dispatching at the same cutoff.
- Around line 198-208: The reservation loop in uat-nightly-batch.yaml is
swallowing real failures because the `gh run watch` call in the run-waiting
block is followed by `|| true`, so failed or timed-out `uat-run.yaml` cells
never affect the job result. Update the logic around the run-watching flow (the
`run_id`/`gh run watch` block) to preserve non-superseded failures: keep the
zero-job superseded handling, but explicitly capture the watch exit status and
propagate it unless the run was cancelled with zero jobs, so this leg fails when
a cell conclusion is failed or timed out.

In `@docs/contributor/uat.md`:
- Line 44: The release verification description is overstating the trusted
signer scope; update the `install-aicr-release` documentation to say the
attestation identity is derived from `aicr_version`, so only the exact release
tag’s `on-tag.yaml@refs/tags/*` identity is accepted. Keep the rest of the
integrity and provenance checks in place, but adjust the wording in the
release-cells section to reflect the exact tag-bound identity check instead of
implying any matching signer is trusted.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/uat-aws.yaml:
- Around line 145-148: The release-cell path still installs ko because Install
tools is passed install_ko: 'true' unconditionally, even though Build and push
validator images is gated off; update the install-tools invocation to disable ko
whenever the job is running a release cell (same conditions used around
aicr_version and skip_tests). Use the existing release-vs-main split in the uat
workflow and the Install tools step to ensure ko is only installed for the main
cell where it is actually consumed.

In @.github/workflows/uat-gcp.yaml:
- Around line 143-146: The workflow still installs ko unconditionally in the
“Install tools” step, so release cells can fail before UAT starts even though
the release-cell build is skipped elsewhere. Update the “Install tools” logic in
the same workflow to skip ko installation when the release-cell path is taken,
matching the existing conditional used by “Build and push validator images” and
the snapshot-agent build gate, so release cells do not download or rely on ko at
all.

In @.github/workflows/uat-nightly-batch.yaml:
- Around line 178-196: The run resolution logic in the uat-nightly-batch
workflow is over-filtering by comparing GitHub run `createdAt` against the
runner-local `since` timestamp. Remove the `createdAt` cutoff from the `gh run
list`/`jq` selection in the dispatch resolution loop, and rely on the unique
`displayTitle` match produced by `dispatch_key` in uat-run.yaml to identify the
correct run. Keep the polling/fail-fast flow intact, but stop rejecting valid
runs solely because of clock skew between the runner and GitHub.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/uat-nightly-batch.yaml:
- Around line 140-161: Validate and sanitize the `DEADLINE_OFFSET_HOURS` input
in the `uat-nightly-batch` workflow before it is used in the Bash arithmetic for
`deadline`. The issue is that `workflow_dispatch` can pass arbitrary strings and
negative values, which would make the cutoff earlier than `BATCH_START`. Add a
pre-check in the `run` block around the `deadline` calculation to reject
anything that is not a non-negative integer, and fail fast with a clear message
before computing the cutoff.