Say the Organization Copilot Runner Wins and Qualify Deploy-Key Claims - #4182

Summary

• Copilot runner precedence (Say Whether an Organization Copilot Runner Setting or a Repository Workflow Wins #1448, decided part). docs/homelab-runner-selection-plan.md now says the organization setting wins over a setup step's own runs-on while repository customization is disabled, per the maintainer's answer on Say Whether an Organization Copilot Runner Setting or a Repository Workflow Wins #1448. It drops the sentence presenting that runs-on as the runner. It keeps the verify-before-rollout line. GitHub's "Configuring runners" page says that with "Allow repositories to customize the runner type" disabled, every repository uses the organization-level runner type.
• The rename is not made here. The answer on Say Whether an Organization Copilot Runner Setting or a Repository Workflow Wins #1448 also asked to rename copilot-code-review.yml to copilot-setup-steps.yml. GitHub's current documentation names copilot-code-review.yml as the file Copilot code review reads, with copilot-setup-steps.yml as its fallback. So the plan keeps copilot-code-review.yml, and the remaining rename question is Decide Whether the Runner Plan Keeps copilot-code-review.yml as Its Code Review Workflow #4181. Say Whether an Organization Copilot Runner Setting or a Repository Workflow Wins #1448 stays open until Decide Whether the Runner Plan Keeps copilot-code-review.yml as Its Code Review Workflow #4181 is answered.

Unfiled defects this run found

• Deploy-key claims that Say Where the Deploy-Site Task Actually Requires the SSH Key #1801's rewording left behind. .github/workflows/deploy-site-task.yml had two comments that assumed the deploy environment always defines DEPLOY_SSH_PRIVATE_KEY. One said the job's own environment binding determines the real value. The other said an unset environment secret reaches the assert step as an empty string. GitHub documents that an environment secret takes precedence over a same-named repository secret, and that the caller must still pass the secret. So a caller mapping a non-empty repository secret, with no environment secret of that name, delivers that value. Both comments are deleted. In docs/reusable-workflows.md, the "Deploy-site." sentence is qualified to "for a secret the environment defines", matching WORKFLOW.md's hugo bullet. The secrets paragraph's "fails its run when one it needs is missing or empty" now reads "reaches its job empty", which the local review pass raised.
• The merge row in AGENTS.md "Where the Rules Live". It routed only to Repository Boundaries and Write Safety. The irreversible-step rule, merging included, also lives in GOVERNANCE.md "Communicating with the User", so the row now names that section too.

Verification

• scripts/build_dist.py --check reports the generated skill distributions current, so no include region reads the changed text.
• The pre-commit gate passed on each commit.
• A local strict review pass is recorded for the pushed head. Round 1 raised one finding, the docs/reusable-workflows.md secrets-paragraph claim, which is fixed. Round 2 raised none.

🤖 Generated with Claude Code