Resolve unavailable pnpm action pin in upstream release workflow #883

PR #881 inspection exposed an existing unresolved action pin in .github/workflows/rust-release.yml:1338:

pnpm/action-setup@a8198c4bff370c8506180b035930dea56dbd5288

This pin is already present in base ce76b1b880; #881 does not change it. A September 8 UTC read of GitHub’s commits API returned “No commit found for SHA” for that exact commit. Both action.yml and action.yaml raw lookups also returned 404. The IDE consequently cannot validate the run_install input.

Determine the intended upstream action/version and repair the pin in a separate reviewed change. Verify the exact action metadata and relevant workflow before claiming readiness. This observation concerns the upstream-shaped rust-release.yml npm packaging path; it does not establish a new blocker in the separate codex-lab-release.yml rehearsal. No running job, release configuration, or pin was changed during the storage review.

Finish line: the intended immutable action reference resolves, its input schema matches this invocation, and relevant workflow validation passes.

Evidence: /Volumes/Developer-Artifacts/codex-lab/storage-evidence/20260908-build-comparison/pnpm-pin-verification.json and package-ide-closeout.json. Related: #881.

Current Status

State: Waiting; Codex Lab is parked by merged DIRECTION.md (PR #1001). This is a retained request, not completed implementation.
Next action: If Chris gives the repository a new purpose or explicitly resumes this need, recheck applicability against that direction before claiming implementation.
Blocked by: No new native issue blocker; existing historical relationships are preserved.
Waiting for: Chris to change Codex Lab direction or explicitly resume this request; archived Lab builds, router and retired milestones do not authorize work.
Last verified: October 9, 2026, SWEEP-OPS-D1; full body, every comment and linked PR records reviewed. Historical acceptance and validation remain in their original sections.