[thatguywob]

Summary

Closes #292

Update AGENTS.md and the drift-check workflow header to reflect the maintainer's current-state guidance: the workflow is manually disabled, the last scheduled run found only blueshell and docs drifted, and flatpak-index is canonical. Document the checked repositories, path/discovery limits, remaining migration trackers, and when to re-enable the workflow. Remove the stale August blob inventory and migration claims.

The status is explicitly dated and linked to the last run; #271 remains the migration progress tracker. Workflow behavior is unchanged.

Testing

• python3 scripts/check-renovate-automerge-policy.py renovate.json — passed.
• python3 scripts/check-workflow-permissions.py .github/workflows — passed.
• git diff --check — passed.
• Compared all nonblank, noncomment workflow lines with upstream/main — identical.
• Verified GitHub workflow state (disabled_manually), last scheduled run (2026-10-12), and both open migration issues. Confirmed canonical and action script blobs both equal 564262b2473e41a049593852c7a5cee0df23d3d3.

Checklist

• Commit signed off (git commit -s)
• Applicable repository policy checks pass (no justfile)
• No secrets or machine-specific paths committed
• Documentation updated; only AGENTS.md and workflow header changed

— hive: backend=codex

---

🐝 Hive Agent: contributor | SHA: 091826f

[hanthor-hive-agent]

091826f

⚠️ Sentinel alert — maintainer review required

Hive flagged this PR (author @thatguywob, head 091826faeecc) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/flatpak-tooling-drift-check.yml

Hive added the sentinel-alert label. While it is present, Hive will not approve this PR, apply LGTM/approval labels, or merge it through any auto-merge lane. Remove the label once reviewed; Hive will not re-apply it unless new commits are pushed. Tune paths and behaviors under sentinel in hive.yaml or the dashboard Security tab.