chore: pin Squad CLI activation to 1.0.0

docs/src/content/docs/guide/gh-aw.md

@@ -671,7 +671,7 @@ Squad from npm. Set a repository variable to select a specific standalone releas
 
 | Variable | Purpose | Default |
 |----------|---------|---------|
-| `SQUAD_CLI_VERSION` | Standalone GitHub Release tag to install during activation | `v0.13.1` |
+| `SQUAD_CLI_VERSION` | Standalone GitHub Release tag to install during activation | `v1.0.0` |
 
 Set it in **Settings → Secrets and variables → Actions → Variables**. A value
 without the leading `v` is accepted for compatibility with older configurations.
@@ -2029,7 +2029,7 @@ Understanding the two-job architecture helps when debugging.
 The activation job runs with full network access:
 
 1. Optionally mints a GitHub App installation token
-2. Resolves `SQUAD_CLI_VERSION` (default `v0.13.1`) and downloads the matching
+2. Resolves `SQUAD_CLI_VERSION` (default `v1.0.0`) and downloads the matching
    standalone GitHub Release bundle with checksum verification — no npm install
 3. Preserves a committed team with roster entries, or runs
    `squad init --preset default --state-backend local` when no usable team exists

test/gh-aw-quality.test.ts

@@ -4001,8 +4001,8 @@ describe('gh-aw: canonical package integrity contract', () => {
       expect(mutable).not.toContain(actionReference);
       expect(createHash('sha256').update(normalizeCompiledLock(mutable, revisionA)).digest('hex'))
         .toBe(sourceBinding === 'workflow'
-          ? 'c86cd65d09ee74d8da4dfec27f64ccba818d22f282c5a4acf33f04e04f5d6bd6'
-          : '206fcc936e5c03e81928565104bc7b2fef9c492f9e8152b17df563bd07e5065a');
+          ? 'e59431b2a2fa9872287449df5cb779c11ce4361206397c181047051446fb9a95'
+          : '919f1c77ee340bda1ca79d3e1c513fc2ddb2f3d89428133691e2b62699ce71de');
       expect(() => validateCompilerActionPins(mutable)).toThrow(/invalid immutable action pin/);
       writeFileSync(lockPath, mutable);
       expect(verifyInstall(root).failures.join('\n'))
@@ -4056,7 +4056,7 @@ describe('gh-aw: canonical package integrity contract', () => {
     compile();
     const unpinned = readText(lockPath);
     expect(createHash('sha256').update(normalizeCompiledLock(unpinned, revisionA)).digest('hex'))
-      .toBe('206fcc936e5c03e81928565104bc7b2fef9c492f9e8152b17df563bd07e5065a');
+      .toBe('919f1c77ee340bda1ca79d3e1c513fc2ddb2f3d89428133691e2b62699ce71de');
     expect(verifyInstall(root).failures.join('\n')).toContain('Installed digest mismatch');
 
     const seedPins = () => spawnSync(process.execPath, ['--input-type=module', '-e', seed!], {

workflows/package/squad-deps-worker.md

@@ -603,7 +603,7 @@ jobs:
       - name: Resolve Squad standalone release
         id: squad-release
         env:
-          SQUAD_CLI_VERSION: ${{ vars.SQUAD_CLI_VERSION || 'v0.13.1' }}
+          SQUAD_CLI_VERSION: ${{ vars.SQUAD_CLI_VERSION || 'v1.0.0' }}
         run: |
           set -euo pipefail
           release_tag="${SQUAD_CLI_VERSION}"

workflows/package/squad-implement-worker.md

@@ -738,7 +738,7 @@ jobs:
       - name: Resolve Squad standalone release
         id: squad-release
         env:
-          SQUAD_CLI_VERSION: ${{ vars.SQUAD_CLI_VERSION || 'v0.13.1' }}
+          SQUAD_CLI_VERSION: ${{ vars.SQUAD_CLI_VERSION || 'v1.0.0' }}
         run: |
           set -euo pipefail
           release_tag="${SQUAD_CLI_VERSION}"

workflows/package/squad-retro.md

@@ -723,7 +723,7 @@ jobs:
       - name: Resolve Squad standalone release
         id: squad-release
         env:
-          SQUAD_CLI_VERSION: ${{ vars.SQUAD_CLI_VERSION || 'v0.13.1' }}
+          SQUAD_CLI_VERSION: ${{ vars.SQUAD_CLI_VERSION || 'v1.0.0' }}
         run: |
           set -euo pipefail
           release_tag="${SQUAD_CLI_VERSION}"

workflows/package/squad.md

@@ -668,7 +668,7 @@ jobs:
       - name: Resolve Squad standalone release
         id: squad-release
         env:
-          SQUAD_CLI_VERSION: ${{ vars.SQUAD_CLI_VERSION || 'v0.13.1' }}
+          SQUAD_CLI_VERSION: ${{ vars.SQUAD_CLI_VERSION || 'v1.0.0' }}
         run: |
           set -euo pipefail
           release_tag="${SQUAD_CLI_VERSION}"

workflows/shared/squad.md

@@ -22,7 +22,7 @@
 # SQUAD_GITHUB_TOKEN > github.token.
 #
 # Optional custom Squad CLI version: vars.SQUAD_CLI_VERSION.
-# Default is v0.13.1.
+# Default is v1.0.0.
 # This is a GitHub Release tag whose standalone assets are installed without
 # npm; values without a leading `v` are normalized for older configs.
 #
@@ -493,7 +493,7 @@ jobs:
       - name: Resolve Squad standalone release
         id: squad-release
         env:
-          SQUAD_CLI_VERSION: ${{ vars.SQUAD_CLI_VERSION || 'v0.13.1' }}
+          SQUAD_CLI_VERSION: ${{ vars.SQUAD_CLI_VERSION || 'v1.0.0' }}
         run: |
           set -euo pipefail
           release_tag="${SQUAD_CLI_VERSION}"

workflows/squad-workflows.manifest.json

@@ -14,18 +14,18 @@
       "source": "workflows/package/squad.md",
       "destination": ".github/workflows/squad.md",
       "lock": ".github/workflows/squad.lock.yml",
-      "source_sha256": "450e9d3d7ef1b173cedd054d89e72700d8545406bd1fe0acd813d5ed76e04e91",
-      "lock_sha256": "c5d6e1b7a42e7f4b7dd748ae59c762d08acba9f20e0d6328290eec72e5358717",
-      "package_lock_sha256": "d0688be3e9492288091c103bd55d6e2845f4541f9e6915db2d4a84e488d4b763"
+      "source_sha256": "13410dac23af6144454e29a7fbf697fe7808fd30d2c848a1d3887cc822fdf3f0",
+      "lock_sha256": "a34fc39cae668ec2dd6fdae615110ec8d270a910b293c6a49bb3b3ab4b175f67",
+      "package_lock_sha256": "b7d60a96cf9251bfe2ca30274d523618b0495f903bb187518c4e3c0e026732ac"
     },
     {
       "name": "squad-implement-worker",
       "source": "workflows/package/squad-implement-worker.md",
       "destination": ".github/workflows/squad-implement-worker.md",
       "lock": ".github/workflows/squad-implement-worker.lock.yml",
-      "source_sha256": "40067547110aa4c3186091265a2d77a1f05b8e1c0cca92a274470838d12e1ec3",
-      "lock_sha256": "11610f64c32403acb69b8f111f0fe584572a0e715bcb53eccaa5bd0cacaa57b5",
-      "package_lock_sha256": "c6b34a8ae8e9848bbc964a0ca73080ab9c06a9b9238de860954f84f0ba1bf5d7"
+      "source_sha256": "8ad749285633009e5f51d5d2bf61f2e9a916a89f4ad652a67948f8242c86c84b",
+      "lock_sha256": "826e8ae57f71a1feda39cab749dbaba959f3e0f9fbe31248ba60f1134edc35ee",
+      "package_lock_sha256": "a6832e5cc8b6c5a1c688fdd2e172d479cdf84f1a9edc5cc574595f642126972c"
     },
     {
       "name": "squad-review",
@@ -41,18 +41,18 @@
       "source": "workflows/package/squad-deps-worker.md",
       "destination": ".github/workflows/squad-deps-worker.md",
       "lock": ".github/workflows/squad-deps-worker.lock.yml",
-      "source_sha256": "8057ff2e4cb2a6be55da43092397a890880fb94cadfe8d0dd15766dd22f1fe9e",
-      "lock_sha256": "31ece8146cf21ca5aec2880fd5daa01b982f037a961d3fd0b7c50a6eb3893dd4",
-      "package_lock_sha256": "59f035683a2b2dbecabdb685ff8280b05c4a081cf3d934a1f77591902b8e83a1"
+      "source_sha256": "1ff0e1553c25647182b51ea0462c245e1a0b6e24da1de7739e7dbbe8ed9b766b",
+      "lock_sha256": "238010921a3acae1336c999e23e786d08fbfc343e1c4f69c463f03dd649898ab",
+      "package_lock_sha256": "04322d836ef81f1512038ef3c5118ea507e82c49325c9d3371db62ea1cc9879e"
     },
     {
       "name": "squad-retro",
       "source": "workflows/package/squad-retro.md",
       "destination": ".github/workflows/squad-retro.md",
       "lock": ".github/workflows/squad-retro.lock.yml",
-      "source_sha256": "8d7e1fdd5fa337da8208832b1cc7c6dbfd253dde2c1b45a7f68a805eb9025620",
-      "lock_sha256": "41fe367f5391eea781a0045adff8cb5039a689123b5b1798367a0078e19073e9",
-      "package_lock_sha256": "19933818ea4a2a89040e9e12706f80b56e6b6d6e53925f92c66f88d99676184f"
+      "source_sha256": "bd788f921eed90bebc16ee18527c457ac51e8e5a32a1295ca7ee0c0fbbf025ce",
+      "lock_sha256": "f5dfa3fc2000710f2a3d4dd40443c46926d1f09a556e88c2fe1ef9c91cf55e3b",
+      "package_lock_sha256": "baa17a0f571f2e821e6d204e8b4edf98687da62d95ed6e22923fff20fd6a9367"
     },
     {
       "name": "squad-improvement-worker",
@@ -161,7 +161,7 @@
       "package_destination": ".github/aw/squad/runtime/shared/squad.md",
       "destination": ".github/workflows/shared/squad.md",
       "ownership": "manifest",
-      "sha256": "4cddc662ecd98f9fcd8e8623e908a2bd1a75c30c12bbcf98e3ad26db93135a66"
+      "sha256": "8c36f9dd49d5a2e9dcbeaa40f4f38659c427950a362ac1f8efeb6405944860ce"
     },
     {
       "path": "shared/squad-planning-ontology.md",