docs(release-notes): behaviour → behavior (Argus smoke test)

[bokelley]

Summary

Two instances of British spelling "behaviour" in docs/reference/release-notes.mdx. Repo convention is US spelling (158 "behavior" vs 2 "behaviour" before this fix).

Why this PR exists

This PR is the smoke test for #3488 — the new Argus AI review workflow. The PR is intentionally tiny and benign so we can verify the end-to-end pipeline (App-token mint → prompt build → Argus LLM run → `gh pr review` post → verifier confirm) on a docs-only change before exercising any MUST-FIX gates.

Expected outcome: Argus reviews this PR, classifies as docs-only (no `code-reviewer` delegation needed), and posts `--approve`.

Test plan

• CI green
• Argus posts a `--approve` review within 10 minutes of the PR opening
• Argus skips subagent delegation (docs-only PR)
• Review body uses bokelley voice (concise, declarative, sign-off ladder)

[aao-release-bot]

Smoke-test PR does what it says — two-char docs fix on a load-bearing US-spelling convention (158:2 before this PR), plus the Argus workflow bootstrap. Right shape: small payload, real wire (App-token mint → prompt build → claude-code-action → verifier).

Things I checked

• docs/reference/release-notes.mdx — two behaviour → behavior replacements, both inside narrative prose. No schema, no wire surface, no SDK impact.
• .changeset/argus-smoke-test.md — patch bump on adcontextprotocol matches the typo-only payload.
• .changeset/auto-approve-routine-prs.md — empty ---\n--- frontmatter is valid for @changesets/cli (precedent in codeowners-maintainers-team.md, move-changeset-guidance-to-playbook.md). No bump emitted, release notes still surface. Intentional.
• .github/workflows/ai-review.yml:34,42 — pull_request trigger + actions/checkout@v4 of head.sha. Fork PRs cannot mint the App token (secrets.RELEASE_APP_PRIVATE_KEY is unavailable on pull_request events from forks per GitHub secret-isolation policy). Fail-closed for forks.
• .github/workflows/ai-review.yml:101-115 — is_trivial() correctly excludes .github/workflows/*.yml, package.json, CODEOWNERS. Workflow/dependency changes trigger full re-review.
• Largest-file rule satisfied — read .github/workflows/ai-review.yml (219 net lines) and .github/ai-review/expert-adcp-reviewer.md (231 net lines) in full.
• Schema-vs-docs audit — N/A. No static/schemas/source/** touched.
• Test-plan honesty — three unchecked items ("Argus posts `--approve`", "skips subagent delegation", "uses bokelley voice") are self-validating by this review. The author cannot manually verify them prior to merging the workflow that produces them; that's the smoke-test design. Not a block. Side note: subagent delegation was NOT skipped — the PR adds .github/workflows/ai-review.yml (non-docs source), so per the prompt's own rules code-reviewer + security-reviewer ran. Expected outcome line in the PR body is wrong on that point.

Follow-ups (non-blocking — file as issues)

1. paths-ignore is a no-op when a PR also touches a non-ignored path. .github/workflows/ai-review.yml:28-30 — GitHub paths filters are any-match-outside-the-list. A PR that edits .github/ai-review/expert-adcp-reviewer.md AND any other file still runs the workflow, which cats the modified prompt from the PR's working tree at L143. Threat: a same-repo contributor with write access injects prompt instructions that drive Argus to --approve, satisfying branch protection's "1 review required" check. (security-reviewer: High.) Override reasoning: fork vector is closed by secret-isolation; residual same-repo write-access attacker is within the trust boundary that already grants branch-push. Mitigation when convenient: read the prompt via gh api .../contents/...?ref=\$BASE_SHA, or move to pull_request_target with head.repo.full_name == github.repository gating.

2. Bash(gh api:*) allowlist is broad. .github/workflows/ai-review.yml:170 — the wildcard lets Argus call any REST endpoint within the App token's scope. Narrow to enumerated read-only patterns. Audit the App's installation scope; confirm it's installed only on adcontextprotocol/adcp and that its permissions don't include administration or write surfaces beyond pull-requests:write. (Both code-reviewer and security-reviewer flagged.)

3. review_posted verifier false-positives on other bot reviews. .github/workflows/ai-review.yml:78,185 — both jq filters select user.type == \"Bot\" with no login pin. A --comment from changesets-release[bot] or any other bot in the last 10 minutes is treated as Argus's review. Add .user.login == \"<argus-app-bot-slug>\" to both filters.

4. Pin third-party actions to commit SHAs. actions/checkout@v4, actions/create-github-app-token@v1, anthropics/claude-code-action@v1, actions/github-script@v7 — all moving tags. A force-push to any of these tags ships in the next workflow run with the App token and ANTHROPIC_API_KEY in scope.

5. Trivial-skip path carries stale approval across force-pushes. .github/workflows/ai-review.yml:65-131 — if a PR receives a bot approval, then force-pushes to a SHA whose diff against the prior-approved SHA only touches *.md/*.mdx/mintlify-docs/*, Argus skips re-review and the prior approval still counts. Real risk only when the bot's approval is the load-bearing one — which is the design. Either drop the shortcut when the prior review was bot-authored, or invalidate the bot approval on force-push.

Minor nits (non-blocking)

1. macOS date fallback is unreachable. .github/workflows/ai-review.yml:195 — the || date -u -j -f ... BSD form never fires under runs-on: ubuntu-latest, and under set -euo pipefail both branches failing aborts the verify step. Harden with || echo 0.

2. \$GITHUB_OUTPUT heredoc sentinel is static. .github/workflows/ai-review.yml:145,155 — ARGUS_EOF is a constant. Repo-controlled prompt makes this informational today; becomes load-bearing if follow-up 1 isn't addressed.

LGTM. Follow-ups noted below.