chore(ci): migrate workflows to velnor-actions 0.1.0

.github/AGENTS.md

@@ -1,5 +1,32 @@
-# Generated files
+# Generated by Velnor Actions 0.1.0; edit .velnor/config.toml and regenerate.
+# Generated GitHub Workflows and Configurations
 
-Everything under `.github` is generated by [velnor-workflow](https://github.com/tailrocks/velnor/tree/main/crates/velnor-workflow).
+All files and subdirectories under `.github/` are generated by `velnor-actions` from [tailrocks/velnor-new](https://github.com/tailrocks/velnor-new).
 
-Never hand-edit this directory. Changes to generated behavior require a Velnor PR: first research, analyze, and independently verify a generic solution, never a repository-specific workaround. Keep generation inputs outside `.github`, then regenerate. Root `AGENTS.md` rules still apply.
+## Do Not Hand-Edit `.github/`
+
+- **Never hand-edit any file inside `.github/`**: Every manual change will be overwritten on the next run of `velnor-actions generate`.
+- **Keep generation inputs outside `.github/`**: Repository configuration belongs in `.velnor/config.toml`, workspace manifests, and toolchain settings outside `.github/`.
+- **Regenerate via CLI**: Apply configuration changes by running `velnor-actions generate`.
+
+## Workflow Issues and Enhancements
+
+When issues, bugs, limitations, or enhancements are observed in generated GitHub Actions workflows:
+
+1. **Do NOT patch `.github/` directly or create repo-specific workarounds**:
+   - Avoid local ad-hoc patches, overrides, or shims inside `.github/`.
+2. **Research generic solutions in `velnor-actions` / `velnor-new`**:
+   - Investigate solutions in the upstream generator: [tailrocks/velnor-new](https://github.com/tailrocks/velnor-new).
+   - Verify that potential changes align with the vision and architectural invariants of Velnor Actions (generic workflow generator, strict safety invariants, zero legacy, fast CI).
+3. **Analyze and verify with subagents**:
+   - Compare proposed designs against the current implementation in `velnor-new` using detailed subagent analysis.
+   - Use multiple subagents to review the concept, implementation details, and edge cases.
+4. **Submit PR to upstream `velnor-new`**:
+   - Only after thorough verification and review, submit a PR to `velnor-new` (https://github.com/tailrocks/velnor-new).
+5. **Regenerate workflows**:
+   - After the fix is merged in `velnor-new`, update/regenerate the workflows using `velnor-actions generate`.
+
+## Root Repository Rules
+
+- If a root `AGENTS.md` is present in this repository, all of its rules, invariants, and guidelines apply here as well.
+- In case of conflict, stricter safety, correctness, and verification standards take precedence.

.github/actionlint.yaml

@@ -1,7 +1,7 @@
-# Generated by velnor-workflow. Regenerate; do not hand-edit.
-# Runner labels are derived from the generated workflow contract.
-# The actionlint catalog can lag GitHub-hosted labels; keep this allowlist generated.
+# Generated by Velnor Actions 0.1.0; edit .velnor/config.toml and regenerate.
+
+config-variables: []
 
 self-hosted-runner:
   labels:
-    - ubuntu-24.04
+    - ubuntu-26.04