chore: record harness learnings (#3131)

.github/AGENTS.md

@@ -17,11 +17,20 @@ Apply this guidance whenever editing `.github/**`.
 - PR label/metadata cleanup jobs that operate on pull requests must declare
   `pull-requests: write`, not `issues: write`; mirror the permission shape used
   by `preview-env.yml`.
+- **Workflow and checkout identity:** A `workflow_dispatch` uses the workflow
+  definition at the selected dispatch ref. An explicit `checkout` of `main`
+  selects the files that subsequent steps consume. It does not replace the
+  running workflow definition. Record `github.workflow_ref`,
+  `github.workflow_sha`, and the checkout SHA separately. Attribute failures
+  to the definition or consumed files before deciding which branch needs a fix.
 - Release workflow changes must trace prepare/summary outputs and conditions
   through every build and publication job: skip decisions must propagate
   without accidental publishing, while backfill must reuse and validate the
   existing tag and still run its required build/publication path. Verify each
   actual publication job and artifact, not only the aggregate workflow result.
+- When validating a public artifact through redirects, inspect the final HTTP
+  status, content type, effective URL, and non-empty body. Intermediate
+  redirect headers do not prove that the delivered artifact is valid.
 - For workflow security changes, run the relevant raw workflow-contract tests,
   `python3 .github/scripts/lint-action-pinning_test.py`, `zizmor .github/workflows`,
   and `git diff --check`.