[dsyme]

Summary

Fix the two compilation blockers identified by CI on #406 and #407, without changing the inference engine or broadening network access.

• Remove unsupported native tools.web-fetch from .github/workflows/daily-repo-goals.md and .github/workflows/link-checker.md.
• Use the existing GitHub read tools and proxy-aware curl instead. Explicitly enable link-checker's bash tool, which its prompt already needs for reading the deterministic link report.
• Keep existing network allowlists, TLS verification and GitHub agent repository-read permissions; retain existing Copilot authentication permissions.
• Treat firewall/transient fetch failures as verification blockers, not permanent link removal to cache.
• Regenerate both tracked lock files with gh-aw v0.93.3. The larger lock diff is compiler/runtime regeneration, not a wider authored workflow rewrite.

This is a standalone branch from main; it does not include the Repo Assist behaviour changes.

Validation

• Focused compilation of both repaired workflows: 2 succeeded.
• gh aw compile --no-emit over all hosted workflows: 5 succeeded. This removes the previously observed first-stage CI blockers.
• Freshness: both changed workflows report Yes.
• Assertions verified preserved allowlists and no new GitHub agent mutation permissions.
• git diff --check: passed.
• No workflow was manually dispatched or executed. A diagnostic --dry-run attempt was stopped when it unexpectedly began broad historical artifact downloads; it emitted no diagnostic lock. The results above are ordinary compile-only validation, not a passed dry-run gate.

The current compiler still reports generated-scaffolding warnings (not suppressed here), notably undeclared admission outputs and persisted-checkout credentials. Other reusable samples are outside this two-workflow fix.

Generated dependency and safety review

A read-only safety review found no confirmed vulnerability in the changed scope. Runtime telemetry destination values and live firewall/agent behaviour were not verified; no secret values were retrieved and no live agent run is claimed.

Compiler regeneration adds the optional GH_AW_DEFAULT_OTLP_ENDPOINT secret reference as an alternative to the existing administrator-configured variable of the same name, using the existing OTLP headers/destination mechanism. No redirect changes. The compiler also adds its normal activation-job failure-reporting permission; the agent's repository permissions remain read-only.

Generated SHA-pinned dependency updates, checked against official tags:

• gh-aw-actions setup v0.88.3 -> v0.93.3 (e89a5670dc4c790b37ade361215b8d72d8ce8942)
• download-artifact v8.0.1 -> v8.0.2 (9000827ccba6bdab643e8b6fd33ac0654aef8333)
• upload-artifact v7.0.1 -> v7.0.2 (cf430e030ddbb5b0abf93d22962f4752f3646cd9)
• setup-node v7.1.0 added by compilation (949feb2413d6458794dcd2491c4babbbce0c15c1)

Shared action-cache churn is excluded. The two authored changes preserve the firewall/allowlist boundary; bash curl is not a bypass for unavailable native web tools.

[dsyme]

Hosted CI update: the initial hosted-workflow compilation stage now passes all 5 workflows, confirming the two requested fixes. The subsequent reusable-sample stage reaches 61 templates: 47 compile, while 14 other unchanged samples fail on their own unsupported tools.web-fetch declarations. Details: https://github.com/githubnext/agentics/actions/runs/40115931512. Those other templates are outside this narrowly scoped two-workflow PR; this is not an all-green repository-wide CI claim.