Copilot instructions

1# Review CI and action bumps carefully
2 
3For GitHub Actions, CI, toolchain, base image, or packaging bump PRs, review the effective change, not just the version or SHA update.
4 
5Check for impact on:
6 
7- workflow permissions and token usage
8- defaults, inputs, deprecated behavior, and runner compatibility
9- test reliability and coverage
10- release, packaging, provenance, and published artifacts
11- cache behavior, artifact handling, reproducibility, and multi-platform builds
12 
13Do not approve only because the change is in workflows, is SHA-pinned, or CI passes.
14 
15In the review summary, state what changed, what was inspected, and any remaining risk or recommended verification.
16