v1.91.45.0 feat: configurable model tiers and advisory freshness (#3073)

* feat: add configurable model tiers and advisory freshness

* fix: disclose role selections before Claude review execution

* fix: reject malformed model policies and keep model pins portable

* fix: separate readiness diagnostics and bound version checks

* fix: preserve actionable model failures and validate review inputs before probes

* fix: retry released probe locks and retain late-rejection repair context

* feat: finalize configurable model tiers and verified release repairs

* fix: preserve strict model policy reads on Windows

* fix: keep fixture probes read-only and clarify pending CEO decisions

* fix: verify native terminal closure before bounded descriptor settlement

.github/workflows/model-policy-freshness.yml

@@ -0,0 +1,49 @@
+name: Model-policy freshness
+
+on:
+  schedule:
+    - cron: '0 11 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: model-policy-freshness
+  cancel-in-progress: false
+
+jobs:
+  advisory:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 8
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
+        with:
+          bun-version: 1.4.2
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+      - name: Check and publish main advisory
+        if: github.ref == 'refs/heads/main'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          MODEL_FRESHNESS_REPORT: ${{ runner.temp }}/model-policy-freshness.json
+        run: bun scripts/model-policy-freshness.ts --publish
+      - name: Check non-main without publication
+        if: github.ref != 'refs/heads/main'
+        env:
+          MODEL_FRESHNESS_REPORT: ${{ runner.temp }}/model-policy-freshness.json
+        run: bun scripts/model-policy-freshness.ts
+      - name: Preserve evidence report
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: model-policy-freshness-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/model-policy-freshness.json
+          if-no-files-found: error
+          retention-days: 90