[hippo] Add stale-workflow-output guard for markdown workflow edits

[github-actions]

Summary

Recurring Hippo memories show that workflow markdown edits frequently land without regenerated .lock.yml outputs, causing CI churn and review noise. This is one of the clearest repeated workflow-health incidents in the memory store and has a single reliable remediation: run make recompile.

Memory: mem_4afaa0965161, mem_54f44b8a2960, sem_94dc733c4052

Why this matters

The memory store marks this as a recurring incident rather than a one-off mistake. Encoding the expectation in a stronger automated guard would reduce preventable failures and stop authors from relying on tribal knowledge.

Next steps

• Inspect existing stale-output checks around workflow compilation and .lock.yml generation.
• Add or tighten a validation path that fails when .github/workflows/*.md changes do not have matching regenerated outputs.
• Cover the guard with tests and document the expected fix command: make recompile.
• Verify the change with the repository’s normal workflow validation commands.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 🦛 Daily Hippo Learn · gpt54 29.3 AIC · ⌖ 10.8 AIC · ⊞ 5.4K · ◷

• expires on Jul 24, 2026, 11:10 PM UTC-08:00

[github-actions]

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · gpt54 2.98 AIC · ⌖ 10.3 AIC · ⊞ 8.2K · ◷