#7)

Root cause of the persistent "Repository has changed during renovation"
aborts since PR #4 — Renovate was calling POST /repos/{owner}/{repo}/
statuses/{sha} after each branch creation to write a stability status
check (tied to the cooldown / merge-confidence flow). The workflow's
permissions block had contents:write, pull-requests:write, issues:write
but not statuses:write, so the call 403'd with "integration-
unauthorized". Renovate's error handler maps that internally to
"repository-changed", which is why every prior debugging attempt
(checkout, configurationFile, dry-run env, digest pin) chased the
wrong symptom.

Confirmed via debug log on run 25346172853:
  Request failed with status code 403 (Forbidden):
  POST .../statuses/cf3dc7d1...
  "x-accepted-github-permissions": "statuses=write"
  DEBUG: Caught error setting branch status - aborting
  Error: integration-unauthorized
  DEBUG: Passing repository-changed error up

The earlier hypothesis fixes in PRs #5 and #6 weren't wrong per se
(actions/checkout and configurationFile aren't the cause, and
RENOVATE_DRY_RUN='' isn't either) — they just couldn't have fixed the
underlying permission gap. With statuses:write added, Renovate's
post-branch status-check call should succeed and the run should
complete normally.

Confirmed in production run 25346453345: the regex manager stats
showed `"regex": {"fileCount": 4, "depCount": 56}` instead of the
expected 2/28. With `configurationFile: .github/renovate.json5`
passed, the action mounts the file as Renovate's global config AND
Renovate auto-discovers the same file from the cloned working tree;
both loads register the customManagers and every annotation gets
extracted twice. The doubling produced 14 "Cannot find replaceString
in current file content. Was it already updated?" warnings across
the four created branches — Renovate's first pass applied the
replacement, the second pass tried to re-apply but the content no
longer matched.

PR #6 added `configurationFile:` chasing the "repository-changed"
aborts under the wrong hypothesis; PR #7 found and fixed the actual
cause (missing `statuses: write` permission). With #7 in place we
can drop `configurationFile:` cleanly. Earlier dry-run experiments in
RENOVATE_PLATFORM=local mode had already shown this doubling, but I
mis-attributed it to local-mode specifics. Production confirms the
behavior is the same.

`actions/checkout` stays — it's not the cause of any issue we've
seen, and the upstream gpu-operator pattern keeps it.

Audit findings #5 and #6: the pointer file was duplicating fingerprint,
criteriaMatch, phaseSummary, and attestedAt — nearly a copy of the
predicate, with no Go consumer reading the denormalized fields. Two
sources of truth with no good answer for which to trust on mismatch.

A pointer's job is to *locate* the signed bundle, not to summarize it.
A reviewer who wants fingerprint dimensions or per-phase pass/fail
counts fetches the bundle from PointerBundle.OCI and reads
predicate.json — that's the authoritative copy and the only one.

  Before                                 After
  ──────                                 ─────
  schemaVersion                          schemaVersion
  recipe                                 recipe
  attestations[]:                        attestations[]:
    bundle                                 bundle
    signer                                 signer       (omitempty)
    attestedAt                             attestedAt
    fingerprint        ──── DROPPED
    criteriaMatch      ──── DROPPED
    phaseSummary       ──── DROPPED  (also resolves audit #6:
                                      pointer phaseSummary block
                                      omitted .skipped despite
                                      predicate carrying it)
    logsBundle         ──── DROPPED  (feature deferred in 0277fec;
                                      will return as omitempty
                                      when log capture lands)

Wire changes:

  - PointerAttestation: 7 fields → 3.

  - PointerFingerprint, PointerCriteriaMatch, PointerPhaseStat,
    PointerLogsBundle types deleted along with their build helpers
    (pointerFingerprintFrom, pointerPhaseSummaryFrom).

  - PointerInputs.LogsBundle dropped — no caller ever populated it.

  - Schema version stays at 1.0.0; no committed pointer files exist
    yet and the design doc's '2.0.0 reserved for multi-instance'
    plan is preserved.

Test coverage:

  - TestBuildPointer_OmitsDenormalizedFields: asserts the rendered
    YAML has no fingerprint:, criteriaMatch:, phaseSummary:, or
    logsBundle: keys. Catches regressions where a future commit adds
    a field back without updating the design rationale.

  - Existing fingerprint round-trip and logsBundle round-trip tests
    deleted (they asserted denormalization that no longer happens).

Design doc (docs/design/007-recipe-evidence.md):

  - Pointer schema example shrunk to match.

  - Added 'The pointer is a locator, not a denormalized cache'
    paragraph documenting the rationale.

  - Verifier step 7 updated to read criteriaMatch from the predicate
    rather than the pointer.

  - Verifier step 11 (logs bundle verification) marked deferred
    pending log capture; spelled out that V1 pointers omit the field
    entirely so verifiers don't error on absence.

Audit findings #5 and #6: the pointer file was duplicating fingerprint,
criteriaMatch, phaseSummary, and attestedAt — nearly a copy of the
predicate, with no Go consumer reading the denormalized fields. Two
sources of truth with no good answer for which to trust on mismatch.

A pointer's job is to *locate* the signed bundle, not to summarize it.
A reviewer who wants fingerprint dimensions or per-phase pass/fail
counts fetches the bundle from PointerBundle.OCI and reads
predicate.json — that's the authoritative copy and the only one.

  Before                                 After
  ──────                                 ─────
  schemaVersion                          schemaVersion
  recipe                                 recipe
  attestations[]:                        attestations[]:
    bundle                                 bundle
    signer                                 signer       (omitempty)
    attestedAt                             attestedAt
    fingerprint        ──── DROPPED
    criteriaMatch      ──── DROPPED
    phaseSummary       ──── DROPPED  (also resolves audit #6:
                                      pointer phaseSummary block
                                      omitted .skipped despite
                                      predicate carrying it)
    logsBundle         ──── DROPPED  (feature deferred in 0277fec;
                                      will return as omitempty
                                      when log capture lands)

Wire changes:

  - PointerAttestation: 7 fields → 3.

  - PointerFingerprint, PointerCriteriaMatch, PointerPhaseStat,
    PointerLogsBundle types deleted along with their build helpers
    (pointerFingerprintFrom, pointerPhaseSummaryFrom).

  - PointerInputs.LogsBundle dropped — no caller ever populated it.

  - Schema version stays at 1.0.0; no committed pointer files exist
    yet and the design doc's '2.0.0 reserved for multi-instance'
    plan is preserved.

Test coverage:

  - TestBuildPointer_OmitsDenormalizedFields: asserts the rendered
    YAML has no fingerprint:, criteriaMatch:, phaseSummary:, or
    logsBundle: keys. Catches regressions where a future commit adds
    a field back without updating the design rationale.

  - Existing fingerprint round-trip and logsBundle round-trip tests
    deleted (they asserted denormalization that no longer happens).

Design doc (docs/design/007-recipe-evidence.md):

  - Pointer schema example shrunk to match.

  - Added 'The pointer is a locator, not a denormalized cache'
    paragraph documenting the rationale.

  - Verifier step 7 updated to read criteriaMatch from the predicate
    rather than the pointer.

  - Verifier step 11 (logs bundle verification) marked deferred
    pending log capture; spelled out that V1 pointers omit the field
    entirely so verifiers don't error on absence.