fix(ci): restore toolchain pin on main + guard sync-pin-on-pr against protected branches

[Wikid82]

Unblocks main — verify-toolchain-pin is currently red on every PR

Fix 1 (commit 1): restore the toolchain pin

6f38be5c ("chore(docker): sync toolchain image pin to
caddy-crowdsec-9eb9862f44b9e769"), authored by github-actions[bot] at
07:51 UTC, was pushed directly to main. It is toolchain-image.yml's
sync-pin-on-pr job running on the bot-authored main -> development
auto-propagation PR #1307: that job checks out
github.event.pull_request.head.ref — which for a propagation PR is main —
recomputes the toolchain key against the merge ref (which pulls in
development's c32e611a gRPC 1.83.2 bump, a toolchain-key input) and commits
the two-line pin bump onto the head branch.

main's actual recipe still has GRPC_VERSION=1.83.1, whose key is
caddy-crowdsec-1efe7f19fa52a512. The pin now on main points at the
gRPC-1.83.2 key, so scripts/verify-toolchain-pin.sh fails everywhere.

This commit reverts 6f38be5c exactly (two ARG lines), restoring:

ARG	value
CHARON_TOOLCHAIN_TAG	caddy-crowdsec-1efe7f19fa52a512
CHARON_TOOLCHAIN_DIGEST	sha256:6575f4c6a9f76074870c64df9dd4c9ebee812342f37f52ae5ef8f511ba9f8f00

This is the pair set at c0ee1195, CI-green at e3b76d04, and the digest
#1300's docker-build actually pulled
(#17 [toolchain-prebuilt] FROM …@sha256:6575f4c6…).

Verified on this branch:

• bash scripts/toolchain-key.sh → caddy-crowdsec-1efe7f19fa52a512 (matches restored TAG)
• docker buildx imagetools inspect ghcr.io/wikid82/charon-toolchain:caddy-crowdsec-1efe7f19fa52a512 → sha256:6575f4c6a9f76074870c64df9dd4c9ebee812342f37f52ae5ef8f511ba9f8f00 (matches restored DIGEST)

Fix 2 (commit 2): stop sync-pin-on-pr from ever pushing to a long-lived branch

The job's only guard was github.actor != 'github-actions[bot]', which did
not fire here — the propagation PR's pull_request event runs under a
non-bot actor even though the PR is bot-authored with head ref main. Added to
the job if::

• refuse any protected head ref outright — main / development / nightly /
  feature/beta-release (this job has no business rewriting a long-lived branch
  in place);
• also skip when the PR author is github-actions[bot]
  (github.event.pull_request.user.login), not just the triggering actor;
• existing actor guard retained.

Legitimate toolchain-key moves on development remain handled by the
open-bump-pr job (a reviewed bot PR), which is unchanged.

No in-tree harness asserts on workflow if: guards (bats covers the scripts,
not the YAML); actionlint passes. A yq-based assertion could be added later.

Relationship to other in-flight PRs

• #1306 (integration-test consolidation) already squash-merged to main as 255a23df — unaffected by this.
• #1308 (integration image artifact retention 1d → 3d) is a separate tiny follow-up, also based on main; it will go green once this PR lands and it is rebased.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[github-actions]

✅ Supply Chain Verification Results

✅ PASSED

📦 SBOM Summary

• Components: 1769

🔍 Vulnerability Scan

Severity	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	0
🟢 Low	0
Total	0

📎 Artifacts

• SBOM (CycloneDX JSON) and Grype results available in workflow artifacts

---

_{Generated by Supply Chain Verification workflow • View Details}