- Template fetches GSTACK_REF with git fetch, so a full commit sha works as the
comment says; actions are pinned to the SHAs gstack's own workflows use; the
exit code reaches Publish through env and the report is no longer echoed to
the log.
- The rate-limit preflight keeps a tenth of the hour's limit spare (at most
500), so a GITHUB_TOKEN with a little of its hour spent still runs.
- Job, runner and workflow names are escaped in the report and issue body.
- ship-check drops runs whose head repository is not the PR's (fork branches
that share a name).
- Docs say the /ship step lands in a follow-up PR; egress scanner exempts the
template with its reason.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
