Record catalog provenance and workflow platform version in consumer lock

[vitormattos]

Goal

Make consumer workflow updates auditable as versioned platform updates, not only byte-level template changes.

Current state

actions/sync-workflows/sync.py stores an MD5 digest per installed workflow in .github/actions-lock.txt.

That is sufficient to detect whether a catalog YAML file changed, and the synchronization code correctly refuses unexplained local divergence. However, the lock does not currently identify:

• the github-workflows platform release (for example v0.3.0);
• the immutable source/catalog commit;
• the LibreCodeCoop/.github catalog revision from which a workflow was materialized.

As a result, a consumer can answer "which bytes were installed" but not directly "which released workflow platform/catalog produced them".

Requirements

Design a backward-compatible lock/provenance format that records, at minimum:

• workflow filename;
• content digest using a modern digest for provenance (prefer SHA-256);
• workflow platform version when published from a tagged release;
• immutable source or catalog commit SHA used by the sync run.

Preserve the existing safety properties:

• only installed workflows are managed;
• consumer-local <workflow>.patch remains authoritative for local differences;
• unexplained divergence fails closed;
• a failed local patch does not silently replace the consumer workflow.

Update semantics

A platform/catalog version change with identical workflow bytes should not force a meaningless workflow rewrite, but provenance may still be updated when useful and reviewable.

A workflow content change must remain visible as a normal consumer PR.

Migration

• parse existing two-column MD5 lock files;
• migrate them deterministically on the next successful synchronization;
• avoid losing management state for already adopted workflows.

Acceptance criteria

• the consumer can identify the exact platform/catalog provenance of each managed workflow;
• old lock files migrate without manual intervention;
• SHA-256 or stronger replaces MD5 for new provenance records;
• unchanged workflow bytes do not create noisy rewrites;
• tests cover migration, update, local patch, divergence and patch-failure behavior.

[vitormattos]

Completion evidence:

• actions/sync-workflows v2 lock implementation is released in github-workflows v0.4.0 at immutable SHA 002f17274ba1eade3351ba81890bf53674b37c43;
• legacy two-column MD5 locks remain readable and migrate on successful sync;
• new records use SHA-256 and carry platform version, immutable github-workflows source SHA and catalog SHA;
• provenance-only changes update the lock without rewriting unchanged workflow YAML;
• divergence/local patch/patch-failure safety remains covered by tests;
• the public LibreCodeCoop/.github catalog now passes platform-version: v0.4.0, the immutable source SHA and the exact checked-out catalog SHA into the action.

Catalog publication was merged in LibreCodeCoop/.github#36.