@@ -8,6 +8,24 @@ body:
     attributes:
       value: |
         Thanks for sharing your story. Maintainers review issues with the `contributor-story` label and may promote verified stories to hivecommons.dev/stories.
+
+        <!--
+        FOR MAINTAINERS AND AGENTS PICKING THIS ISSUE UP — where the story goes:
+
+        * Published page: https://hivecommons.dev/stories/
+        * Source of that page: repository hivecommons/hivecommons.github.io,
+          file stories/index.html, section "Stories we can link today"
+          (<h2 id="real-stories-title">). It is a hand-edited static GitHub
+          Pages site (no build step); copy an existing story card verbatim and
+          fill in name, profile link, avatar (https://github.com/<handle>.png),
+          project, role, PR/issue link, and the quote (only if "Can we quote
+          you by name?" is checked). Run scripts/check-links.sh and
+          node --test scripts/*.test.mjs there, then open a PR against main
+          referencing this issue. It goes live when that PR merges.
+        * Do NOT add stories to this repository (hivecommons/hive): not to the
+          hub's static pages, not to src/docs. There is no stories page here
+          and one must not be created (see #10644 / #10653).
+        -->
   - type: input
     id: name
     attributes:
 
@@ -86,6 +86,9 @@ pinned:
   # v4 is feature-frozen and not being imported as the initial Hive Commons
   # CNCF FOSSA project.
   fossa.yml: [-v4]
+  # GitHub Actions Workflow triage compiles only on the active v5 line; older
+  # release lines do not carry the gh-aw automation surface.
+  gh-aw-compile.yml: [-v4]
   go-security-analysis.yml: [v5, v6]
   # Unit gate for the reusable hive action's app-handle helper (#9707). The
   # action and its smoke wiring live only on the v6 development line, so the
 
@@ -1,4 +1,10 @@
 #!/usr/bin/env bash
+# Gate policy (#10443): push-triggered runs only call update-branch on PRs whose
+# changed files intersect the push. Incident recovery is served by the
+# marker-driven re-run (SHARED_CI_INCIDENT, #10442), which bypasses that gate.
+# An "N commits behind base" trigger (N~5) is deliberately not implemented; revisit
+# no earlier than 14 days after #10458 merges, sizing N from its update-branch
+# success / 422 / 403 counts.
 set -euo pipefail
 
 REPO="${GITHUB_REPOSITORY:?GITHUB_REPOSITORY is required}"
 
@@ -5,14 +5,16 @@
 #
 # #7206 baked gcc/libc6-dev/tmux into the ARC runner image so race shards stop
 # depending on apt egress from the cluster — the failure class behind #6648 →
-# #6870 → #6935 → #7124 → #7201 → #7289. The Dockerfile merged on 2026-09-16;
-# a day later the image still did not exist on GHCR, because publishing it was
-# left to "an operator with docker + GHCR write", and two more shards had died
-# at "Prepare cgo toolchain" in the meantime. This workflow removes the GHCR
-# half of that operator dependency: the build runs here, on a GitHub-hosted
-# runner, with the job's own GITHUB_TOKEN (packages: write). What remains for
-# an operator is the one thing CI cannot do — `kubectl patch` the
-# RunnerDeployment in `arc-systems` to the tag this run prints.
+# #6870 → #6935 → #7124 → #7201 → #7289. The image also carries GitHub CLI so
+# `gh`-driven automation can move off the hosted lane after this image is rolled
+# out. The Dockerfile merged on 2026-09-16; a day later the image still did not
+# exist on GHCR, because publishing it was left to "an operator with docker +
+# GHCR write", and two more shards had died at "Prepare cgo toolchain" in the
+# meantime. This workflow removes the GHCR half of that operator dependency:
+# the build runs here, on a GitHub-hosted runner, with the job's own
+# GITHUB_TOKEN (packages: write). What remains for an operator is the one thing
+# CI cannot do — `kubectl patch` the RunnerDeployment in `arc-systems` to the
+# tag this run prints.
 #
 # ── Where it runs ───────────────────────────────────────────────────────────
 #
@@ -28,17 +30,18 @@
 # workflow_dispatch  builds AND pushes. Inputs pick the base runner image and
 #                    the tag suffix; the pushed tag is
 #                    ghcr.io/<owner>/hive-ci-runner:<runner version>-<suffix>,
-#                    e.g. v2.337.0-ubuntu-24.04-toolchain-1 — immutable by
+#                    e.g. v2.337.0-ubuntu-24.04-toolchain-gh-1 — immutable by
 #                    construction, as runner-image-patch.yaml requires. A
 #                    re-run with the same suffix is refused rather than
 #                    overwriting: ARC does not re-pull an unchanged tag, so a
 #                    silently replaced tag would make "which toolchain are the
 #                    runners on?" unanswerable.
 # pull_request       builds only (no login, no push), path-filtered to the
 #                    Dockerfile and this file. The Dockerfile verifies
-#                    `gcc --version` / `tmux -V` during the build, so this is
-#                    the CI gate that keeps a Dockerfile change from shipping
-#                    an image that quietly sends shards back to the mirrors.
+#                    `gcc --version` / `tmux -V` / `gh --version` during the
+#                    build, so this is the CI gate that keeps a Dockerfile
+#                    change from shipping an image that quietly sends shards
+#                    back to the mirrors or lacks the CLI.
 #
 # No `push:` trigger, on purpose. A merged Dockerfile change must not roll a
 # new image tag on its own: the tag only matters once an operator patches the
@@ -73,7 +76,7 @@ on:
           (<runner version>-<suffix>). Bump it for every rebuild on the same
           base; an existing tag is never overwritten.
         required: true
-        default: toolchain-1
+        default: toolchain-gh-1
         type: string
   pull_request:
     paths:
@@ -108,7 +111,7 @@ jobs:
       #
       # The tag is <version part of the base image ref>-<suffix>: for
       # summerwind/actions-runner:v2.337.0-ubuntu-24.04 and suffix
-      # toolchain-1 that is v2.337.0-ubuntu-24.04-toolchain-1 — the exact
+      # toolchain-gh-1 that is v2.337.0-ubuntu-24.04-toolchain-gh-1 — the exact
       # example in README.md § "Baking the CI toolchain". Deriving it from the
       # base ref (rather than taking a free-form tag input) means the tag
       # always says which runner release it was built on, which is what the
@@ -201,7 +204,7 @@ jobs:
             org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
             org.opencontainers.image.revision=${{ github.sha }}
             org.opencontainers.image.base.name=${{ steps.ref.outputs.base }}
-            org.opencontainers.image.description=hivecommons/hive self-hosted CI runner with gcc/libc6-dev/tmux baked in (#7206)
+            org.opencontainers.image.description=hivecommons/hive self-hosted CI runner with gcc/libc6-dev/tmux and gh baked in (#7206)
 
       # Hand the operator exactly what the README's "Apply" step needs: the
       # immutable reference (tag and digest) and the two commands. This is the
@@ -243,7 +246,7 @@ jobs:
             else
               echo "| built (not pushed) | \`$REF\` |"
               echo
-              echo "PR gate only: the Dockerfile built and its \`gcc --version\` / \`tmux -V\` verification"
-              echo "passed. Nothing was pushed. Dispatch this workflow from \`v4\` to publish."
+              echo "PR gate only: the Dockerfile built and its \`gcc --version\` / \`tmux -V\` / \`gh --version\` verification"
+              echo "passed. Nothing was pushed. Dispatch this workflow from \`v5\` to publish."
             fi
           } >> "$GITHUB_STEP_SUMMARY"
@@ -30,7 +30,7 @@ permissions:
 
 jobs:
   coverage:
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.HIVE_RUNNER_LABELS || '["ubuntu-latest"]') }}
     # Hard cap so a hung runner / stuck -race build auto-fails instead of
     # blocking PR merges indefinitely (the go test -timeout only bounds the test
     # step, not checkout/setup/build/post-processing or a wedged runner). #3615.
@@ -70,7 +70,7 @@ jobs:
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: src/go.mod
-          cache-dependency-path: src/go.sum
+          cache: false
       - name: Guard shared Go cache (fall back when the runner volume is full)
         # The checkout above is pinned to the MEASURED ref, not the branch this
         # workflow file lives on, so the helper script only exists when that ref
@@ -159,7 +159,7 @@ jobs:
             [tracing]=85
             [review]=80
             [retro]=82
-            [github]=89      # 91.8% on 2026-09-01
+            [github]=88      # 88.9% on 2026-10-05
             [hivectl]=88
             [knowledge]=89
             [proxy]=89
@@ -394,7 +394,7 @@ jobs:
     # pull_request, an unscoped condition would additionally file an issue for
     # every contributor's red PR.
     if: always() && github.event_name == 'schedule' && needs.coverage.result != 'success'
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.HIVE_RUNNER_LABELS || '["ubuntu-latest"]') }}
     needs: coverage
     permissions:
       contents: read
 
@@ -207,7 +207,7 @@ jobs:
   # runs on every PR that touches the checker, its tests, or this workflow.
   checker-selftest:
     name: Self-test the DCO checker
-    runs-on: ubuntu-latest
+    runs-on: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && fromJSON(vars.HIVE_RUNNER_LABELS || '["ubuntu-latest"]') || 'ubuntu-latest' }}
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -222,7 +222,7 @@ jobs:
     # (the PR's own commits are covered by the pre-merge DCO check), so the
     # monitor half sits out and only the self-test above runs.
     if: github.event_name != 'pull_request'
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.HIVE_RUNNER_LABELS || '["ubuntu-latest"]') }}
     timeout-minutes: 10
     strategy:
       fail-fast: false
 
@@ -39,7 +39,7 @@ permissions:
 jobs:
   dco-push-delta:
     name: DCO check on newly pushed commits
-    runs-on: ubuntu-latest
+    runs-on: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && fromJSON(vars.HIVE_RUNNER_LABELS || '["ubuntu-latest"]') || 'ubuntu-latest' }}
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
@@ -28,7 +28,7 @@ permissions:
 jobs:
   squash-attribution:
     name: Sign-off survives the squash
-    runs-on: ubuntu-latest
+    runs-on: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && fromJSON(vars.HIVE_RUNNER_LABELS || '["ubuntu-latest"]') || 'ubuntu-latest' }}
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1