chore: upgrade feature-assess to gh-aw v0.88.7

[KSchlobohm]

Summary

Upgrade feature-assess from gh-aw v0.79.8 to v0.88.7 and Copilot engine 1.0.80.

Changes

• Regenerate .github/workflows/feature-assess.lock.yml.
• Add the immutable setup-cli action pin.
• Adapt the local Spec Kit installation command for gh-aw v0.88.7 package validation.
• Add positive and negative regression tests for setup behavior, triggers, permissions, safe outputs, verdict labels, and action pins.

No other workflows are upgraded.

Validation

gh aw compile feature-assess --strict --validate
  1 succeeded, 0 warnings

pytest tests/test_github_workflows.py -k feature_assess_upgrade -v
  2 passed

ruff check tests/test_github_workflows.py
  Passed

git diff --check
  Passed

Fork end-to-end tests:

• Positive test: five ordered assessment comments and one feature-needs-clarification verdict.
• Negative test: stopped after intake and applied only feature-invalid.
• All six workflow jobs succeeded in both positive and negative runs.

These are integration smoke tests, not a comprehensive evaluation of assessment accuracy.

Agent disclosure

Authored and submitted on behalf of @KSchlobohm by GitHub Copilot (model: GPT-5.6 Sol, autonomous).

[Copilot]

Copilot review overview

🟡 Changes recommended

Add assertions covering the labeled issue trigger and safe_outputs permissions.

Get a fresh assessment by requesting another Copilot review.

Review tier: Lite (auto)
Findings: 2

Note

Copilot is running an experiment and ran this review at Lite.

Open findings (2)

• Regression test does not verify the workflow trigger · New
• Assert permissions on the write-capable jobs · New

What changed in this PR

Upgrades feature-assess to gh-aw v0.88.7 and Copilot 1.0.80, with updated CLI setup and regression coverage.

Changes:

• Regenerates the compiled workflow.
• Adds the immutable setup-cli pin.
• Updates Spec Kit installation validation.
• Adds workflow regression tests.

File	Summary
tests/​test_github_workflows.py	Adds upgrade checks; trigger preservation and safe_outputs permission assertions remain needed.
.github/​workflows/​feature-assess.md	Updates local Spec Kit installation.
.github/​workflows/​feature-assess.lock.yml	Regenerated workflow for gh-aw v0.88.7.
.github/​aw/​actions-lock.json	Adds the pinned setup-cli action.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Four moderate regression-test findings remain unresolved.

Review tier: Lite (auto)
Findings: 1

Note

Copilot is running an experiment and ran this review at Lite.

Open findings (1)

• Regression test does not verify the workflow trigger

Resolved findings (1)

• Assert permissions on the write-capable jobs

Previously missed findings (1)

In code that hasn't changed since last review

Make the trigger regression test enforce the full trigger

tests/​test_github_workflows.py:239

This regression only checks that the label expression appears as a substring; it never asserts the issues: labeled trigger and would pass if an unrelated event or label were added. Assert the parsed trigger and complete if expressions (or exercise representative feature/non-feature events) so the test actually proves this workflow cannot activate for other triggers.

[Copilot]

Copilot review overview

🔵 Needs a closer look

The workflow and security-sensitive generated configuration changes warrant final human review.

Review tier: Lite (auto)
Findings: None

Note

Copilot is running an experiment and ran this review at Lite.

Resolved findings (1)

• Regression test does not verify the workflow trigger