fix(automation): harden nightly dispatch, pins, and audit roles

[ORESoftware]

Outcome

Make the nightly clients controller a single durable GitHub-hosted schedule and make every automation branch update fast-forward-only.

Why

The live 2026-08-20 reliability drill exposed two misleading daily runs: the substantive run could fail while the DST-companion trigger completed green after only the clock gate. GitHub now supports an IANA timezone on scheduled workflows, so the duplicate trigger and gate are no longer needed.

• Live fleet audit: https://github.com/zed-pkg/.github/actions/runs/32417343768
• Live clients hardening: https://github.com/zed-pkg/.github/actions/runs/32417478355
• PR-branch Zed audit verification: https://github.com/zed-pkg/.github/actions/runs/32424641536

Changes

• schedule one run at 03:17 America/Chicago, preserving DST behavior while avoiding the top-of-hour dispatch window;
• remove the duplicate-trigger clock gate and add an explicit report timeout;
• replace force-with-lease writes for the CLI lock and client hardening branches with ordinary pushes;
• preserve divergent or concurrently updated bot branches and fail closed instead of rewriting them;
• refresh checkout and artifact actions to immutable Node 24-compatible revisions;
• prefer the canonical <prefix>-lib-core repository when a historical <prefix>-lib predecessor still exists;
• add executable contracts for the schedule, branch ancestry check, and no-force-push invariant;
• update operator documentation.

Risk and roll-forward

The scheduled start moves from 03:00 to 03:17 Chicago time. Manual dispatch remains available. If GitHub rejects the timezone field, the controller contract check will fail on this pull request and the default-branch schedule remains unchanged. The Zed audit will now name zed-lib-core, but it remains red until resolver-backed client and CLI dependencies are added. The change is additive and reviewable; no branch history, artifact, issue, or existing pull request is deleted.

Security impact

This narrows automation behavior by removing history-rewriting pushes. Existing secret boundaries and fail-closed validation remain unchanged. The separately missing ZED_PKG_TOKEN is not introduced or bypassed by this change.

Validation

• bash -n tools/audit_harden_client.sh
• Python compile checks for controller and tests
• 14 nightly-controller unit/contract tests passed
• Zed repository-role regression test passed
• PR-branch audit selected zed-lib-core and reported only the two expected missing consumer edges
• YAML parsed successfully
• git diff --check

No merge conflicts were encountered. Cross-repository behavior remains limited to the existing zed-pkg/zed-cli lock branch and discovered client review branches.

Linear project: https://linear.app/denman/project/githubcomzed-pkg-5a53230ae6cc
Fleet context: ORESoftware/k8s-cluster#1222