[dsyme]

Summary

Follow up #408: its two hosted-workflow repairs pass, but the next CI stage still fails on unsupported native tools.web-fetch entries in 14 reusable samples. This PR fixes every remaining occurrence and validates the entire existing CI pipeline, without skipping templates or disabling linting.

• Remove the 14 unsupported declarations, as recommended by the current compiler's copilot-web-fetch-removal migration.
• Preserve external-reference research through GitHub read tools and proxy-aware curl; preserve existing unrestricted bash settings, adding only curl to the three existing restricted lists (daily triage, planning, weekly research).
• Give link-checker only cat and curl, covering its existing report-reading instructions and reference fetching, rather than unrestricted shell access.
• Keep accessibility review on its existing Playwright browser instead of adding bash or referring to unavailable WebFetch/WebSearch tools.
• Update prompts, link-checker documentation and contributor validation instructions. Distinguish blocked/transient fetches from permanently removed content; do not cache firewall failures as unfixable links.

No changes to engines, inference drivers, triggers, network allowlists, GitHub permissions, safe-output configuration, or existing non-fetch tools. No new package/MCP dependency or firewall/TLS bypass. No CI checks are removed, weakened or ignored.

Validation

Using the same gh-aw v0.93.3 release currently installed by CI, ran its exact commands:

python3 -m unittest discover -s tests -p 'test_repo_assist_*.py'
gh aw compile --verbose
gh aw compile --workflows-dir workflows --verbose

• 12 guard tests passed.
• 5/5 hosted workflow inputs compiled.
• 61/61 sample inputs compiled, with zero compilation errors (previously 47 succeeded / 14 failed).
• All 49 runnable sample locks report fresh; the other 12 sample entries are existing redirect aliases and correctly report N/A.
• Compared YAML frontmatter against the base for all 14 migrations: the only differences are removal of native fetch and the explicit minimal shell additions listed above. All other metadata, tools, network/permission and safe-output settings match.
• git diff --check passed.

Compiler warnings remain visible (51 hosted / 473 sample warnings), including pre-existing generated-scaffolding and checkout warnings; none are suppressed. This is successful compilation, not a claim that the agentic workflows were run live. No manual workflow dispatch.

Sample workflows/*.lock.yml files are intentionally gitignored; their locks were regenerated and checked locally rather than force-added. Unrelated tracked lock, maintenance-workflow and action-cache churn from full compilation is excluded. No source changes to the CI workflow are needed.

This is a new standalone PR against current main, which already includes #408.

[dsyme]

Hosted CI is now green on commit 2914231: https://github.com/githubnext/agentics/actions/runs/40117214533. All 12 guard tests passed; gh-aw v0.93.3 compiled all 5 hosted workflow inputs and all 61 sample inputs successfully. Warnings remain visible; no checks were skipped or weakened.