ci(agda): pin the Agda proofs job to ubuntu-24.04

[hyperpolymath]

Summary

ubuntu-latest now resolves to ubuntu-26.04. Its apt agda is 2.8.0, which rejects an option that agda-stdlib v1.7.3 sets: Unrecognized option: --warn=noUserWarning. As a result the dogfood-proofs-ci.yml Agda job fails on main, and on every PR that touches its path filter (seen on #444).

This PR pins that one job to ubuntu-24.04. That image ships agda 2.6.3, the version the corpus is verified against. The other jobs are unchanged.

This is a stopgap. The lasting fix is to move the stdlib to a tag that works with Agda 2.8 (and port any proofs that break), then remove the pin. The comment beside runs-on says so.

Changes

• .github/workflows/dogfood-proofs-ci.yml: the agda job uses runs-on: ubuntu-24.04 instead of ubuntu-latest, with a comment explaining why and when to unpin.

RSR Quality Checklist

Required

• Tests pass: no code changed. The job's own run on this PR is the test.
• Code is formatted: n/a (one-line YAML change)
• Linter is clean: the file parses as YAML (Bun.YAML.parse). actionlint is not installed here, so it was not run.
• No banned language patterns
• No unsafe blocks without // SAFETY: comments
• No banned functions
• SPDX license headers present on all new/modified source files (header unchanged)
• No secrets, credentials, or .env files included

Testing

• Validated locally that the workflow still parses as YAML.
• I have not yet seen this job pass on 24.04. This PR's own CI run of the Agda job is that check, and I'll watch it.

---

Generated by Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 18 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 82042174-338f-4bb2-9808-d48063d6fcab

📥 Commits

Reviewing files that changed from the base of the PR and between 1b04dee and 9d80e15.

📒 Files selected for processing: 1

• .github/workflows/dogfood-proofs-ci.yml

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[hyperpolymath]

The red T1 Guix manifest check is not caused by this PR. It fails with E: Unable to locate package guix before touching anything this PR changes, and it fails the same way on main. The job is continue-on-error (allow-fail: issue=#416 expires=2026-11-30), so it doesn't block merging.

It probably has the same cause as the Agda failure: the 26.04 image apparently no longer carries the guix package. I haven't verified that, and I've left it out of this PR to keep the PR to Agda. The job would need its own runs-on: ubuntu-24.04 pin and a proper run to confirm.

---

Generated by Claude Code

[hyperpolymath]

governance / Validate Hypatia Baseline is red here too. It also fails on main and on #444. On #444 I traced it to three actions.lock v0.0.3 findings that main also has, none from files that PR touches. On this run I only looked at the end of the log, which is the baseline dump, so I haven't confirmed which findings are new here. This PR changes only the runs-on line of one job. I don't expect that to add a finding, but I haven't proved it. The fix belongs in the baseline or actions.lock (on main), not in this PR.

---

Generated by Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T13:39:15.236226Z	d801226	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.