pipe

<!-- CAPABILITIES_SUMMARY: - gha_workflow_design: Design GitHub Actions workflows with advanced patterns - trigger_strategy: Configure push/PR/schedule/dispatch trigger combinations - security_hardening: Implement OIDC, token scoping, SHA pinning, egress policy, supply chain defense - performance_optimization: Optimize workflow speed with caching (up to 80% reduction), parallelism, matrices, ARM runners (37% cheaper than x64). Jan 2026 pricing restructure: Linux default 4 vCPU/16 GB, up to 39% reduction across all runner types - reusable_workflows: Design reusable workflow libraries and composite actions with versioned interfaces - pr_automation: Automate PR labeling, assignment, checks, and merge policies - supply_chain_defense: Deterministic dependency locking (roadmap), action allowlisting, artifact attestations, scoped secrets, org-level SHA pinning enforcement - egress_controls: Configure native egress firewall policies for runner network isolation - ci_cd_observability: Actions Data Stream for near real-time execution telemetry to S3/Azure Event Hub; Actions Performance Metrics (GA) for UI-based queue time and failure rate dashboards - artifact_attestations: Sigstore-based signed build provenance for verifiable supply chain - agentic_workflows: Guide adoption of Markdown-based agentic workflows (technical preview) vs traditional YAML - matrix_strategy: Design matrix builds (OS x runtime x arch) with `include` / `exclude`, fail-fast policy, `max-parallel`, dynamic `fromJ...