fix(ci): call the lab cost gate at @main

[zacharybalicki]

Summary

The lab provision workflow called the cost gate with @refs/heads/main. GitHub rejects that reusable-workflow ref with HTTP 422, so F-SELF never started a provision run. This changes that one uses line to @main.

The sweeper and the other lab workflows do not call a reusable workflow with that ref. Comments and GITHUB_WORKFLOW_REF checks still say @refs/heads/main, which is the OIDC form GitHub records for a workflow on main.

The release pin allowlist names this exact uses string. CI compares the generated pin report to the tree, so those records moved with the line. NONINTERACTIVE_TEARDOWN_READY stays false. The denylist is untouched.

Evidence

Cost gate is green: https://github.com/vantioai/vantio-open-core/actions/runs/36799577186

Local evidence on Phantom-Box, not in this commit: /home/vantioai/scratch/c8-fself-fsweep-2026-10-01/resume-after-oidc/evidence/

• RESULT.json was recorded at 2026-10-01T01:10:50Z. Classification FAIL, stopped at provision dispatch. Main was a81df8b9dc3852326b8ce0b25f70fe8f70eae3f8. NONINTERACTIVE_TEARDOWN_READY is false and was not edited.
• Cost-gate run 36799577186 completed with success. AssumeRole for vantio-w3-lab-billing-read succeeded. expected_oop_usd is 0 and abort is false. Account 960577828987. Forbidden account 934814114565 was not used.
• provision-dispatch-422.json: POST dispatch of w3-lab-auto-provision.yml on main returned HTTP 422 (AD3C:127A0C:205D03F:69CF829:6ABDB2E7). GitHub said the called workflow vantioai/vantio-open-core/.github/workflows/w3-lab-auto-cost-gate.yml@refs/heads/main is not a valid branch, tag, or commit. No provision run was created.
• The sweeper was not dispatched because provision never started.
• Artifact w3-lab-auto-cost-gate-36799577186.json: expected_oop_usd 0, abort false, reasons empty, worst case $2.00, Free plan read via freetier:GetAccountPlanState in us-east-1. Cost Explorer was not called.
• Untouched: denylist, phantom-box loader, and scripts/aws/w3_lab_auto.py.

Test

node --test scripts/release/ws11/ws11.test.mjs — 14 pass, 0 fail.

Review

CODE_KATE (workflow). Do not merge.

  

[zacharybalicki]

FOUNDER_OVERRIDE_MERGE (not Kate/kvantio review)

• Exact head merged: f05b153fe868705fc0d23c95dbeb351e83e23c5d
• Squash merge SHA: 24d1b102d613acb2cbe2f3b0d04006ace038c758
• Council: PASS
• CI: 8/8 green at tip
• Reason: Unblocks F-SELF/F-SWEEP cost-gate @main uses-ref
• Post-merge: F-SELF → F-SWEEP required; NONINTERACTIVE_TEARDOWN_READY stays false until evidence
• Evidence: override/merges/PR-150-FOUNDER_OVERRIDE_MERGE.md