validate: non-required kjanat/actionlint 1.17.0 parity job beside the pinned 1.7.12 (rhysd upstream inactive) - #449

… pinned 1.7.12

rhysd/actionlint has had no commit on main since 2026-04-19 (none since
2026-06-29), its latest release is still v1.7.12, and issue #719 ("rhysd
(the author) inactive") is open. Add a non-required actionlint-successor
job that runs the immutable, attested kjanat/actionlint v1.17.0 release with
the same download, sha256sum --check and -version/-color pattern as the
required 1.7.12 step, harden-runner in audit mode first, contents: read,
persist-credentials: false and the same SHA-pinned actions. The required
validate job and .github/main-ruleset.json are unchanged.

Local parity (evidence/artifacts/actionlint-successor-parity-20260927/):
both binaries exit 0 with no diagnostics on the 18 workflows at ba1700a and
on this branch, with and without the runner's shellcheck 0.9.0. Fixtures
taken from rhysd v1.7.12 docs/checks.md and the v1.17.0 release notes
classify the upgrade's differences (relocated shellcheck columns, removed
1.7.12 false positives, new true positives, default-on cache policies).
automation.json replaces the actionlint entry's "Maintained" claim with the
dated staleness facts; the selection stays 1.7.12.

SOTA sources: kjanat/actionlint v1.17.0 (commit 08bb2c4f; SLSA provenance
from .github/workflows/release.yml@refs/tags/v1.17.0; CHANGELOG.md and
release notes), rhysd/actionlint v1.7.12 (914e7df2; docs/checks.md),
actions/runner-images images/ubuntu/Ubuntu2404-Readme.md (c9dd57c6),
zizmor 1.30.1.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

… verification-order claims

Repairs the three findings of the cross-family GPT-6 review of #449.

1. compare.py (P2): messages at one (filepath, line, column, kind) key
   were matched by membership, so a duplicated diagnostic vanished (new
   copy) or was counted twice as identical (old copy). They are now
   paired as multisets: Counter & keeps min(old, new) copies, Counter -
   keeps only positive differences, and elements() repeats each message
   by its count. Source: Python docs, collections.Counter,
   https://docs.python.org/3/library/collections.html#collections.Counter
   Reviewer probe: identical=1, only_new=0 before; identical=1,
   only_new=1 after. Reverse probe (old 2 copies, new 1): identical=2
   before; identical=1, only_old=1 after. compare.py has no self-check or
   fixture test to extend.
   Re-run over the six retained report pairs in <scratch> at
   2026-09-28T07:16:23Z: every pairing count is unchanged, each output is
   byte-identical to that run's recorded compare.json, and the fixture
   outputs are byte-identical to fixture-compare-*.json (the membership
   revision reproduces the same files from the same inputs). Recorded as
   receipt.json parity.compare_rerun; classification figures unchanged.

2. Fixture coverage (P3): claim_boundary and the README claimed an
   example of every class, but classification.rows has fixtures == 0 for
   "reworded" and "new false positive" (the receipt's own rows). Both
   now name the five exercised classes and the two without a fixture.

3. Verification order (P3): verification.order said every check preceded
   binary execution, while the receipt's window_utc.note places the
   attestation-count query after parity_end. The order now lists only
   checks with retained output dated before extraction (02:05:48Z) and
   the first -version output (02:05:54Z): the first pass in
   verification.window_utc (verify-start.txt/verify-end.txt), then
   02:04:35Z-02:05:29Z tag lookups, release.yml at the signer digest,
   identity-pinned re-verifies and the four negative controls (retained
   output modification times). The 1.17.0 attestation count (output
   dated 02:17:41Z) and the untimed gh release view read, 1.7.12
   attestation count and shellcheck chain are not claimed as preceding
   execution. The README heading and window sentence now match.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>