gh-fix-ci

SUSPICIOUS. The core GitHub Actions inspection workflow is coherent and uses official GitHub tooling, so supply-chain and data-flow risks are relatively low. The main issue is the contradiction between 'implement only after explicit approval' and a later instruction to fix, commit, and push proactively, which creates disproportionate autonomy and real-world action risk.