chore: update fullsend shim workflow

[fullsend-ai-fullsend]

This PR updates the fullsend shim workflow to match the current template in the .fullsend config repo.

The shim content has drifted from the template — this brings it back in sync.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:35 PM UTC · Completed 9:50 PM UTC
Commit: b439095 · View workflow run →

[fullsend-ai-review]

Review

Findings

Info

• [protected-path] .github/workflows/fullsend.yaml — This PR modifies a file under the protected path .github/. Note: intent-coherence finding cites the managed-file header (This file is managed by fullsend) and bot authorship (fullsend-ai-fullsend[bot]) as authorization for this change. Human approval is still required for protected-path changes.

Previous run

Review

Findings

Low

• [missing-authorization] .github/workflows/fullsend.yaml — No linked issue for a non-trivial change with three distinct behavioral modifications: (1) permissions scoping from workflow-level to job-level, (2) concurrency group isolation for labeled events (#2452), and (3) event filtering restricting labeled triggers to ready-* labels. The managed-file model (file header + bot author) provides implicit authorization through upstream template conformance, but referencing #2452 or the upstream PR in the body would improve traceability.

Info

• [protected-path] .github/workflows/fullsend.yaml — This PR modifies a file under the protected path .github/. Note: intent-coherence finding cites the managed-file header (This file is managed by fullsend) and bot authorship (fullsend-ai-fullsend[bot]) as authorization for this change. Human approval is still required for protected-path changes.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:39 PM UTC · Completed 3:52 PM UTC
Commit: d290aab · View workflow run →