[BatmanAoD]

Removes every self-pin (uses: rigetti/qcs-gha-infrastructure/...@vX.Y.Z) from the repository,
so a release no longer has to rewrite workflow files in the commit its tag points at.

agent-choices.md records the assumptions and choices made while preparing this change. Delete it before merging.

Basis

Verified with a cross-repository caller in
https://github.com/BatmanAoD/gha-experiments-consumer/actions/runs/43278803558:

• A consumer calling outer.yml@v1, where outer.yml calls uses: ./.github/workflows/inner.yml,
  runs inner.yml from the same repository and the same commit as outer.yml
  (tag v1, not main).
  This matches GitHub's documentation:
  "the called workflow is from the same commit as the caller workflow".
• A step-level uses: ./actions/hello inside the called workflow
  resolves against the consumer's checkout.
  So a reusable workflow here cannot use a local composite action.

Limits still apply: at most 10 nesting levels and 50 unique reusable workflows;
secrets and permissions are passed per level, and permissions can only narrow.

Changes

• The 5 nested reusable-workflow calls in rust-cli-release.yml and rust-cli-prerelease.yml
  now use ./.github/workflows/<file>.yml.
• Breaking: the composite actions actions/setup-rust and actions/reset-changelogs are removed.
  Their steps are inlined into each workflow that used them
  (rust-ci.yml ×3, rust-cli-build.yml, rust-integration-tests.yml;
  prepare-release.yml, prepare-prerelease.yml),
  with third-party SHA pins and version comments unchanged.
  The setup-rust copies read their inputs from job-level SETUP_RUST_* variables,
  so all copies are byte-identical.
  The unused sccache path was dropped (no workflow exposed it).
  A gh search code across the rigetti org found no callers outside this repository.
• New scripts/check-inlined-steps (run by lint) fails when inlined copies drift apart.
• New lint step fails if anything under .github/ (or actions/, should it return)
  contains uses: rigetti/qcs-gha-infrastructure/.
  It replaces the step that required each self-pinning file to be listed in knope.toml.
  Another new step rejects a step-level uses: ./... other than ./.github/workflows/.
• ci.yml's setup-rust job runs the inlined steps;
  its reset-changelogs job extracts the script from prepare-release.yml and runs the same three cases.
• knope.toml versioned_files keeps only the README badge.
• dependabot.yml scans / only.
• README: composite-action sections replaced by a short note on why there are none,
  and the "Bumping this repository's own tag" section by "Nested workflows".

macos-14 → macos-latest: nothing left to do, #23 is already on main.

Release and compatibility

• refactor! with a BREAKING CHANGE: footer, so knope should release v0.5.0.
• The release carrying this change is cut by the existing release.yml flow, as before;
  there are no internal pins left for it to rewrite.
• Consumers pinned to v0.4.10 or earlier are unaffected:
  those tags keep their self-pins and their actions/ directory.
• This repository's CI never referenced its own workflows or actions by tag
  (release.yml already calls ./.github/workflows/prepare-release.yml),
  so on this PR every local path resolves to the PR commit.

Validation

• yq parses every workflow.
• shellcheck: clean on scripts/* and on all 50 run: blocks extracted from the workflows.
• scripts/check-inlined-steps passes locally (jq-wrapper yq),
  and fails with the expected three errors on a deliberately mutated copy.
• The self-pin guard found all 12 self-pins on main before the change and none after.
• knope 0.23.0 release --dry-run, in a scratch Git repository with main tagged v0.4.10 plus this commit:
  proposes v0.5.0, touching only README.md and CHANGELOG.md.
• actionlint not run locally (not installed); the lint job runs it.
• The release / prepare-release check fails at checkout (could not read Username for 'https://github.com').
  It fails identically on main and on every pull request since 2026-11-12 16:30 UTC,
  so it is unrelated to this change; most likely RELEASE_TOKEN is expired or revoked.
  CI gate does not depend on it.
• Two adversarial review agents (non-test and test code) found no consumer-visible behavior change;
  their findings on scripts/check-inlined-steps robustness and README wording are fixed.

🤖 Generated with Claude Code

https://claude.ai/code/session_01K3mkz6m3aZBokQhgvfjnSv