Analysis: compiler downgrade (v0.87.1, PR #1999) impact on AW executions — root-caused pre-existing setup-uv bug, not the downgrade

## Context

PR #1999 temporarily downgraded the `gh-aw` compiler from v0.87.10 to v0.87.1 (see #1998 for the rationale — bypassing threat-detection engine failures). This issue documents the post-downgrade verification analysis and proposes next steps.

## What was checked

### 1. Are all AWs consistently referencing `main`?

Yes. All workflows in this repo dogfood themselves via `trigger-*.yml` → `uses: ./.github/workflows/.lock.yml` (relative reusable-workflow refs). Relative refs always resolve to the ref of the calling run, and all triggers (`schedule` / `workflow_dispatch`) run on the default branch. No inconsistency found. (Downstream-facing templates in `gh-agent-workflows/*/example.yml` intentionally pin `@v0` — that's by design for external consumers, not an oversight.)

### 2. Did any new/organic runs surface a downgrade-related regression?

No organic agent runs occurred in the window immediately after the merge (only CI + 2 skipped `workflow_run` triggers). To get signal, 6 representative dispatchable workflows were manually triggered:

| Workflow | Result |
| --- | --- |
| Bug Hunter | ✅ success |
| Docs Patrol | ✅ success |
| Stale Issues Investigator | ✅ success |
| Project Summary | ✅ success |
| Code Complexity Detector | ❌ failed |
| Code Duplication Detector | ❌ failed |

A later scheduled run of **Stale Issues Investigator** (run `33772080263`) also completed successfully.

### 3. Root cause of the 2 failures

Both fail at the **`Expose uv in workspace`** step:

```
UV_PATH:
ln: failed to create symbolic link '/opt/hostedtoolcache/gh-aw-tools/current/x64/bin/uv' -> '': No such file or directory
##[error]Process completed with exit code 1
```

`UV_PATH` is sourced from `steps.setup-uv.outputs.uv-path`, but the preceding **`Setup uv`** step (`astral-sh/setup-uv@v10.0.1`) in these two lock files has no `id: setup-uv`, so the output reference resolves to empty.

**Confirmed NOT caused by the v0.87.1 downgrade:** diffing `gh-aw-code-complexity-detector.lock.yml` and `gh-aw-code-duplication-detector.lock.yml` before/after PR #1999, this exact section (`Setup uv` step + `Expose uv in workspace` step) is byte-identical across both compiler versions. Workflows using the older `astral-sh/setup-uv@v5` path (Bug Hunter, Docs Patrol, Stale Issues Investigator, Project Summary) are unaffected — only workflows that import the `gh-aw-fragments/code-quality-audit.md` fragment (which pulls in the `v10.0.1` action pinning) hit this.

This is a **pre-existing, already-tracked recurring bug**, not a downgrade regression:
- #1996, #1987, #1956 — "[aw] Code Complexity Detector failed"
- #1985, #1954 — "[aw] Code Duplication Detector failed"
- #1982 — "Recurring setup-uv failure pattern across last-7-day failed agent workflow runs"
- #1991 — "Recurring workflow failures from missing uv artifact in agent setup and conclusion artifact fan-out" (deep root-cause writeup, same signature, also flags a cascading conclusion-job artifact-download failure once the detector step aborts)

## Conclusion

No breakage attributable to the v0.87.1 downgrade was found. The compiler downgrade itself appears safe to keep in place. The only failures observed are a known, unrelated `setup-uv` output-id bug affecting workflows built from the `code-quality-audit.md` fragment.

## Proposed next steps (for further analysis / fix)

- [ ] Add `id: setup-uv` to the `Setup uv` step (`astral-sh/setup-uv@v10.0.1`) wherever the compiler template emits the "Expose uv in workspace" step, so `steps.setup-uv.outputs.uv-path` resolves correctly. Determine whether this needs to be fixed upstream in `github/gh-aw` (compiler template) or can be patched locally.
- [ ] Fix the cascading conclusion-job failure (`Unable to download artifact(s): Artifact not found for name: -detection`) that occurs when the detector step aborts before producing its detection artifact — the conclusion job should tolerate a missing artifact gracefully instead of hard-failing.
- [ ] Once fixed, confirm the `github/gh-aw` upstream release that eventually replaces this temporary v0.87.1 pin also carries the fix, so re-upgrading doesn't reintroduce it.
- [ ] Consider consolidating the recurring auto-filed `[aw] Code Complexity/Duplication Detector failed` issues (#1996, #1987, #1985, #1956, #1954, #1982, #1991) once the root cause is fixed, to avoid further duplicate noise.