From d7303369d5773dee7ad032d5bcfaa0789a4adeb0 Mon Sep 17 00:00:00 2001
From: cbeaulieu-gt <8533906+cbeaulieu-gt@users.noreply.github.com>
Date: Fri, 15 May 2026 01:41:22 +0000
Subject: [PATCH] promote: runtime images
 @6590e923860014214c86ce1c8072be2baaa37394

Atomic digest bump across 5 reusable workflows (7 occurrences).
See PR body for OCI labels.
---
 .github/workflows/claude-apply-fix.yml    | 2 +-
 .github/workflows/claude-ci-failure.yml   | 2 +-
 .github/workflows/claude-lint-failure.yml | 2 +-
 .github/workflows/claude-pr-review.yml    | 2 +-
 .github/workflows/claude-tag-respond.yml  | 6 +++---
 5 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/claude-apply-fix.yml b/.github/workflows/claude-apply-fix.yml
index 445b5ed..60c2d8c 100644
--- a/.github/workflows/claude-apply-fix.yml
+++ b/.github/workflows/claude-apply-fix.yml
@@ -40,7 +40,7 @@ jobs:
     # Phase 5: pin the fix overlay image by SHA256 digest. The fix overlay
     # carries the agent set required for code-write tasks (per spec §7.5).
     # Digest source: STAGE 3 build run 25405636887 (post-#200 rebuild, 3bb6a22) — base image bakes safe.directory '*' (#199, #197).
-    container: ghcr.io/glitchwerks/claude-runtime-fix@sha256:099fd3ee04879c81f9f68b613e728622f71b781f28ade06c6d4beb39c9a3f23d
+    container: ghcr.io/glitchwerks/claude-runtime-fix@sha256:4c921493e27f157f7d47b9755bc530d314ff421625ffe7d670ad6308d6bcb0fc
     concurrency:
       group: claude-apply-fix-${{ github.repository }}-${{ inputs.pr_number }}
       cancel-in-progress: false
diff --git a/.github/workflows/claude-ci-failure.yml b/.github/workflows/claude-ci-failure.yml
index b817b82..0e7dbea 100644
--- a/.github/workflows/claude-ci-failure.yml
+++ b/.github/workflows/claude-ci-failure.yml
@@ -57,7 +57,7 @@ jobs:
     # — the same agent set handles read-only and apply paths, behavior is
     # gated by the `auto_apply` input passed to the prompt.
     # Digest source: STAGE 3 build run 25405636887 (post-#200 rebuild, 3bb6a22) — base image bakes safe.directory '*' (#199, #197).
-    container: ghcr.io/glitchwerks/claude-runtime-fix@sha256:099fd3ee04879c81f9f68b613e728622f71b781f28ade06c6d4beb39c9a3f23d
+    container: ghcr.io/glitchwerks/claude-runtime-fix@sha256:4c921493e27f157f7d47b9755bc530d314ff421625ffe7d670ad6308d6bcb0fc
     concurrency:
       group: claude-ci-failure-${{ github.repository }}-${{ inputs.pr_number }}
       cancel-in-progress: true
diff --git a/.github/workflows/claude-lint-failure.yml b/.github/workflows/claude-lint-failure.yml
index 6f73d60..21e87ee 100644
--- a/.github/workflows/claude-lint-failure.yml
+++ b/.github/workflows/claude-lint-failure.yml
@@ -58,7 +58,7 @@ jobs:
     # and the auto-apply path (auto_apply: true) — the composite action's
     # behavior switches on the input, the image does not.
     # Digest source: STAGE 3 build run 25405636887 (post-#200 rebuild, 3bb6a22) — base image bakes safe.directory '*' (#199, #197).
-    container: ghcr.io/glitchwerks/claude-runtime-fix@sha256:099fd3ee04879c81f9f68b613e728622f71b781f28ade06c6d4beb39c9a3f23d
+    container: ghcr.io/glitchwerks/claude-runtime-fix@sha256:4c921493e27f157f7d47b9755bc530d314ff421625ffe7d670ad6308d6bcb0fc
     concurrency:
       group: claude-lint-failure-${{ github.repository }}-${{ inputs.pr_number }}
       cancel-in-progress: true
diff --git a/.github/workflows/claude-pr-review.yml b/.github/workflows/claude-pr-review.yml
index 2fa2606..976ac4a 100644
--- a/.github/workflows/claude-pr-review.yml
+++ b/.github/workflows/claude-pr-review.yml
@@ -55,7 +55,7 @@ jobs:
     # at $PATH_TO_CLAUDE_CODE_EXECUTABLE plus the review-specific agent set
     # (different-eyes guarantee per spec §3.1, §10.2).
     # Digest source: STAGE 3 build run 25405636887 (post-#200 rebuild, 3bb6a22) — base image bakes safe.directory '*' (#199, #197).
-    container: ghcr.io/glitchwerks/claude-runtime-review@sha256:3796f8e59c740b5cf826ef812edb1fa2620326b776a288519a65eb894f104c60
+    container: ghcr.io/glitchwerks/claude-runtime-review@sha256:070447d4f33db5748f91bf4172d3a03a381afd407e1e533d49a28d0993683217
     concurrency:
       group: claude-pr-review-${{ github.repository }}-${{ github.event.pull_request.number }}
       cancel-in-progress: true
diff --git a/.github/workflows/claude-tag-respond.yml b/.github/workflows/claude-tag-respond.yml
index 5df0324..26f6d99 100644
--- a/.github/workflows/claude-tag-respond.yml
+++ b/.github/workflows/claude-tag-respond.yml
@@ -96,13 +96,13 @@ jobs:
           set -euo pipefail
           case "$OVERLAY" in
             review)
-              IMG="ghcr.io/glitchwerks/claude-runtime-review@sha256:3796f8e59c740b5cf826ef812edb1fa2620326b776a288519a65eb894f104c60"
+              IMG="ghcr.io/glitchwerks/claude-runtime-review@sha256:070447d4f33db5748f91bf4172d3a03a381afd407e1e533d49a28d0993683217"
               ;;
             fix)
-              IMG="ghcr.io/glitchwerks/claude-runtime-fix@sha256:099fd3ee04879c81f9f68b613e728622f71b781f28ade06c6d4beb39c9a3f23d"
+              IMG="ghcr.io/glitchwerks/claude-runtime-fix@sha256:4c921493e27f157f7d47b9755bc530d314ff421625ffe7d670ad6308d6bcb0fc"
               ;;
             explain)
-              IMG="ghcr.io/glitchwerks/claude-runtime-explain@sha256:a032e67fa52a98b5ab338d1bfdd4dd4ad63f8ab7ffcf8c8025e4447f33d6867e"
+              IMG="ghcr.io/glitchwerks/claude-runtime-explain@sha256:1192c63ce4cf9a01d3ff105ae86e3fc456ac38d3ab72303b7c99e575804a1f52"
               ;;
             *)
               echo "::error::router emitted status=ok but overlay=$OVERLAY is not in the known set (review|fix|explain). Add the new overlay to the case statement in the 'image' step of the route job (.github/workflows/claude-tag-respond.yml)."