docs(inventory): the contract denied an action-pins gate that is armed (backend#1668)

[LukasWodka]

What

Finding 3 of backend#1668 — "Inventory denies armed action-pins".

.github's own entry in repo-inventory.yml said:

action-pins itself stays unarmed until #159 reaches main

#159 reached main and action-pins was armed on 2026-08-06 (backend#1603 step 2), but that line was never updated. So the single source of truth denied a control the repo actually has — the exact class of staleness this file exists to eliminate.

Verified on origin/develop

• .github/workflows/code-quality-caller.yml passes action-pins: true and action-pins-soft-fail: false
• quality / action-pins is a required status check on .github/develop
• the caller's own comment already says "action-pins armed 2026-08-06 (backend#1603 step 2)" — so the two files contradicted each other

Kept, not deleted

The original caveat stays, because it explains why arming had to wait: a caller may only pass inputs the @main callee declares, or the whole call dies with startup_failure.

Comment-only. Selftest re-run: 97 pass, 0 fail.

Parent epic: backend#1680.

---

Note

Low Risk
Documentation-only change to repo-inventory.yml comments; no workflow or enforcement behavior changes.

Overview
Updates the .githubcode-quality.yml block in repo-inventory.yml so the contract matches what CI already does.

The old note said action-pins stays unarmed until #159 reaches main; that was never revised after 2026-08-06 arming (backend#1603), even though the caller enables action-pins: true with action-pins-soft-fail: false and quality / action-pins is required on develop. The edit records that mismatch (backend#1668) and keeps the startup_failure caveat: callers can only pass inputs the @main callee declares.

^{Reviewed by Cursor Bugbot for commit e734352. Bugbot is set up for automated code reviews on this repo. Configure here.}