docs(agents): the consumer census now searches the monorepo itself

AGENTS.md

@@ -330,7 +330,7 @@ actionlint
 
 The auto-merge workflow's own allow-lists (`TRUSTED_BOT_AUTHORS`, `TRUSTED_TRIGGER_ACTORS` and `TRUSTED_REVIEW_ACTORS` in `.github/workflows/enable-auto-merge.yaml`) decide what that workflow acts on and are maintained only there; they are separate from the agents' trust gate in the monorepo `AGENTS.md`.
 
-**Blast radius first:** a change to a composite action / reusable workflow affects **every consumer repo**. Prefer additive, backward-compatible changes; call out any breaking input/output change prominently in the PR body and treat it as a deliberate decision (keep an alias where feasible). List the consumers first with the monorepo's [`consumer-census.sh`](https://github.com/devantler-tech/monorepo/blob/main/.claude/scripts/consumer-census.sh): from a monorepo checkout, `.claude/scripts/consumer-census.sh "<path inside this repository, such as .github/workflows/<name>.yaml, without owner or ref>"` (that form matches both remote and same-repository callers) prints each caller's `file:line`; read each caller's inputs there, because an input-name search misses callers that rely on a default. An `UNKNOWN` repository was not searched, which is never zero consumers, and the census covers only the default branches of the monorepo's non-archived submodules: check separately callers on this pull request's branch and other active branches, the monorepo's own workflows (devantler-tech/monorepo#4917), repositories that are not submodules, and repositories that an organization ruleset makes run a required workflow.
+**Blast radius first:** a change to a composite action / reusable workflow affects **every consumer repo**. Prefer additive, backward-compatible changes; call out any breaking input/output change prominently in the PR body and treat it as a deliberate decision (keep an alias where feasible). List the consumers first with the monorepo's [`consumer-census.sh`](https://github.com/devantler-tech/monorepo/blob/main/.claude/scripts/consumer-census.sh): from a monorepo checkout, `.claude/scripts/consumer-census.sh "<path inside this repository, such as .github/workflows/<name>.yaml, without owner or ref>"` (that form matches both remote and same-repository callers) prints each caller's `file:line`; read each caller's inputs there, because an input-name search misses callers that rely on a default. An `UNKNOWN` repository was not searched, which is never zero consumers. The output must have a row for `.`, the monorepo itself; a census without that row comes from a checkout older than devantler-tech/monorepo#4925, so update the checkout first. That row searches whatever the checkout calls `origin`, so run the census from a checkout of `devantler-tech/monorepo` itself, never from a fork. The census covers only the default branches of the monorepo and its non-archived submodules: check separately callers on this pull request's branch and other active branches, repositories that are not submodules, and repositories that an organization ruleset makes run a required workflow.
 
 **Validate before any PR:** `actionlint` on every changed workflow/action (else a thorough YAML parse); confirm `uses:` refs resolve and are pinned/aligned; check `inputs`/`outputs`/`shell:` are declared; for reusable workflows keep `on: workflow_call` inputs/secrets backward-compatible. No app build here — YAML correctness + pinning is the gate. Keep all remote actions pinned to full-length commit SHAs. Native `$/` self-references bind to the defining file's repository and exact commit; same-source actions and reusable workflows use this form. Retain source checkouts only where scripts or fixture data still need their files. Deliberately checked-out product-base validators must retain that different source identity. Follow the catalogue guide's self-reference rules; never weaken a security control to pass a check.