ci: restore BytePort workflow syntax and attestations (placement)

[KooshaPari]

Scope

This branch restores the BytePort CI workflow files after newline/control-character corruption and resolves the embedded release-attestation conflict for the placement-readback line. It includes the placement metadata pilot commits already present on this worktree.

Evidence

• PyYAML parse sweep: all workflows parse in pilot, placement-readback, and pr172-rebase worktrees.
• git diff --check: clean.
• Control-character and merged-comment scan: clean for the repaired workflow set.

Remaining gate

actionlint was not runnable locally because the host has Go 1.24.3 while the current actionlint release requires Go 1.25; automatic toolchain acquisition did not yield a binary. Exact-head CI must provide the semantic GitHub Actions gate before merge.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[KooshaPari]

Validation update:

• PyYAML parsed every workflow in the pilot, placement-readback, and pr172-rebase worktrees (0 failures).
• git diff --check is clean.
• Focused Rust check passed on pilot: byteport-transport, byteport-dag, pheno-dag, byteport-cli (cargo check ... --lib -j 1).
• Placement pheno-dag check passed (cargo check -p pheno-dag --lib -j 1).
• Fixed pheno-dag's missing uuid serde feature (the prior check caught three derive errors).
• Full all-target Tauri check remains open because the drive exhausted space; the isolated target was cleaned and reclaimed 1.4 GiB.
• actionlint remains an environment gate: host Go is 1.24.3; current actionlint requires Go 1.25.

[KooshaPari]

CI remediation update:

• Workflow hardening commit ci: pin workflow actions and tighten permissions is now on this branch: all action refs are full SHAs, npm lifecycle installs use --ignore-scripts, npx was replaced with locked local npm exec, and the invalid === expression was corrected.
• Go lint remediation commit fix(byteport): satisfy errcheck and staticcheck gates resolves the 49 logged issues.
• With Go 1.25.0 and GOTOOLCHAIN=local, go test ./... passed locally across backend packages.
• Focused Rust checks and workflow parser checks remain green.
• Remote checks are rerunning; default-branch Dependabot findings (50 total) remain outside this PR's changed scope.

[sonarqubecloud]

Quality Gate failed

Failed conditions
3.3% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud

[KooshaPari]

Audit run 30509379794 (head f2eeeaa34d6589b89019074241c97d6d22cbff4d) reached SonarCloud with the CPD exclusion argument intact (-Dsonar.cpd.exclusions=**/*_test.go). SonarScanner exited before analysis with: You are running CI analysis while Automatic Analysis is enabled. Please consider disabling one or the other. This is a SonarCloud project configuration conflict, not a source/CPD failure. We are leaving the CPD scope unchanged and require the project owner to disable Automatic Analysis before enabling CI analysis.

[KooshaPari]

SonarCloud gate evidence (2026-07-30): the failure is a real duplication gate, not a missing workflow check. Public check output reports 3.6% Duplication on New Code (PR #318; PR #319 reports 3.3%, threshold <=3%). SonarCloud public project settings show sonar.autoscan.enabled=true for KooshaPari_BytePort. The repository scanner config contains sonar.cpd.exclusions=**/*_test.go, but the Automatic Analysis project mode is independent of the CI scanner and is still measuring test fixtures; the PR analysis reports new duplicate blocks in backend/models/*_100_percent_test.go plus provider files. This is not being bypassed here. Remediation requiring project/org admin access: disable SonarCloud Automatic Analysis for KooshaPari_BytePort and keep the pinned CI SonarSource/sonarqube-scan-action as the sole analysis path, then rerun this PR head. Do not relax the quality-gate threshold or broaden exclusions. If Automatic Analysis must remain enabled, the alternative is a source refactor to reduce measured duplication below 3%, followed by a fresh analysis.