[github-actions]

Review on ArchCode

Problem and author intent

Platform returns pending automation runs with null participants, result, event_id, team or user. The previous SDK treated those fields as optional but nonnullable, so present nulls raised during response decoding. This regeneration consumes the corrected public spec and accumulated API changes since the previous refresh.

What changed

• Workflow-generated SDK, spec snapshot and contract tests from archastro-openapi main, generator @archastro/sdk-generator@latest resolved to 0.11.11.
• Five AutomationRun descriptors now accept null. The generated refresh also includes other published API changes; it is broader than the nullability fix.
• Separate handwritten maintenance commit adds required account_created: false to two existing auth fixtures, preserving all assertions.
• Tooling dependency updates patch fast-uri and js-yaml and replace Chokidar 3 with 4 to remove vulnerable braces. Prism watches explicit documents with globbing already disabled. No audit policy changes or new waivers.

Scope: backend SDK and development tooling. No generated file was manually patched.

Testing and risk

• PR CI passes on Elixir 1.15.8 / OTP 26.2 and Elixir 1.20.0 / OTP 27.0: tooling audit, format, compilation, standard tests, channel contracts using the matching harness, and Dialyzer.
• Locally: 1,604 standard tests pass; format and compile pass; tooling audit passes with its existing Faker exception. Independent review found no issues in the handwritten changes.
• Existing .github/workflows/ci.yml runs both modified auth tests through mix test --warnings-as-errors on pull requests. They are unit tests, not live Platform proofs.
• Canonical real Platform proof remains the downstream Evals test services/elixir/evals/test/remote_eval/assessment_server_bundle_e2e_test.exs in firstlanding. After the approved Hex release, that separate PR will use typed invoke/poll and demonstrate red on 0.3.4 and green on the released SDK. Generated contract tests do not replace that proof.

Risk: medium compatibility uncertainty for the accumulated generated refresh until downstream Evals integration is verified. Intended user impact: pending automation runs decode successfully. Release and downstream pin bump are separate steps; this PR does not publish to Hex.

Follow-ups

Human merge, explicitly approved minor release, merge the resulting version-bump PR, and update the Evals exact pin with its real sandbox proof. JavaScript regeneration remains a separate follow-up.