cawplan-qa-commit

SUSPICIOUS: the workflow is internally coherent for QA daily submission, but it relies on an external `cawplan` CLI whose provenance is not verified in the provided evidence. The upload and cloud-query behavior fits the stated purpose, so this is not confirmed malware; the main issue is high trust placed in an opaque required binary with networked actions.