fix: pin SHA-256 checksum for sentrux binary install (RGS-018)

[Copilot]

The Install sentrux step in shared/mcp/sentrux.md downloaded and executed a binary from GitHub Releases with no integrity check — a supply-chain risk (runner-guard RGS-018). A compromised or swapped release asset would run attacker-controlled code with the job's token scope.

Changes

• shared/mcp/sentrux.md — pins SENTRUX_SHA256 for sentrux-linux-x86_64 v0.5.7 and verifies with sha256sum -c - before chmod +x, so the binary is never made executable if the hash doesn't match:

SENTRUX_SHA256="3237f80fe20d54aad4deefa8a143f0d60543bb5d2d6ad891eb42432f155725a6"
curl -fsSL -o /tmp/gh-aw/agent/sentrux "https://github.com/sentrux/sentrux/releases/download/v${SENTRUX_VERSION}/sentrux-linux-x86_64"
echo "${SENTRUX_SHA256}  /tmp/gh-aw/agent/sentrux" | sha256sum -c -
chmod +x /tmp/gh-aw/agent/sentrux

• daily-sentrux-report.lock.yml — regenerated via make recompile.

• Fixes [static-analysis] RGS-018: Suspicious Payload Execution Pattern in daily-sentrux-report.lock.yml #46532

[Copilot]

Pull request overview

Pins and verifies the sentrux binary checksum to mitigate the RGS-018 supply-chain risk.

Changes:

• Adds the verified SHA-256 digest for sentrux v0.5.7.
• Regenerates the compiled workflow with checksum validation.

Show a summary per file

File	Description
.github/workflows/shared/mcp/sentrux.md	Verifies the binary before execution.
.github/workflows/daily-sentrux-report.lock.yml	Applies the generated verification step.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Medium

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.82.14