[aw-maintenance:compiler-security] gh-aw compile fails on daily-runtime-threat-scan.md: zizmor strict-mode check errors despite reporting 0 findings

Compiling `github/gh-aw-actions` with the full gh-aw validation/lint/security-scanner suite fails (exit code 1). The failure is a compiler/zizmor integration anomaly rather than a concrete vulnerability: zizmor reports 0 security warnings/errors, yet the strict-mode gate still fails the build. No actionable vulnerable images, license findings, or other scanner findings were reported. Recommended next action: run the local fixing loop below to have a coding agent (or a human) investigate why the strict-mode check treats a 0-finding zizmor run as a failure and correct the compiler/workflow so it compiles cleanly.

- **Target repository**: `github/gh-aw-actions`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `1`
- **Generated lock files checked**: `1`
- **Result**: findings

### Findings

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| zizmor (via gh-aw compile, strict mode) | `.github/workflows/daily-runtime-threat-scan.md` / `daily-runtime-threat-scan.lock.yml` | unknown | Compile failed with: "strict mode: zizmor found 0 security warnings/errors in daily-runtime-threat-scan.lock.yml - workflows must have no zizmor findings in strict mode". The message is self-contradictory (0 findings reported, yet the strict gate still errors), suggesting a compiler/tool integration bug rather than an actual security issue in the workflow. | Recompile locally to reproduce, inspect the actual zizmor findings JSON/exit status behind this message, and either fix the workflow source so zizmor truly reports 0 findings and the gate passes, or fix the compiler's interpretation of a 0-finding zizmor result. Do not edit the generated `.lock.yml` directly. |

Note: actionlint (with shellcheck/pyflakes) ran without reported issues before the zizmor step failed the build. No vulnerable container images, license, poutine, runner-guard, grant, grype, or syft findings were present in the captured report — the run stopped at the zizmor gate.

### Local fixing loop

1. Install or update the gh-aw extension, then configure the coding agent's MCP client to launch `gh aw mcp-server` over stdio from the target repository (`github/gh-aw-actions`).
2. Give the agent the prompt below and require it to use the `fix` and `compile` MCP tools rather than editing generated `.lock.yml` files.
3. Require the agent to repeat the same full compiler validation and security scan until it passes, or stop and explain any finding that needs human action.

Agent prompt

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw compiler report

```text
✓ .github/workflows/daily-runtime-threat-scan.md (99.2 KB)
i Using actionlint 1.7.12
i Running actionlint (with shellcheck/pyflakes) on .github/workflows/daily-runtime-threat-scan.lock.yml
i Running zizmor security scanner on .github/workflows/daily-runtime-threat-scan.lock.yml
✗ zizmor failed
strict mode: zizmor found 0 security warnings/errors in daily-runtime-threat-scan.lock.yml - workflows must have no zizmor findings in strict mode
```

Diff summary (regenerated lock file, uncommitted local artifact only)

```text
.github/workflows/daily-runtime-threat-scan.lock.yml | 630 +++++++++++++--------
1 file changed, 399 insertions(+), 231 deletions(-)
```

Git status during the run also showed an untracked `.github/aw/logs/` directory (compiler log output, not part of the source diff).

### Control Plane
- Correlation ID: `33830504321-33`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/33830504321

> Generated by [:shield: AW Maintenance / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/33830841623) · copilot · auto · 15.2 AIC · ⌖ 8.16 AIC · ⊞ 13.9K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 18, 2026, 2:52 AM UTC

Start by reproducing the failure with .github/workflows/daily-runtime-threat-scan.md and the gh-aw compile validation, then inspect the zizmor findings JSON and exit status for daily-runtime-threat-scan.lock.yml. Do not edit the generated lock file; trace whether the compiler or workflow source causes the contradictory strict-mode result. Done means the source compiles with strict validation and the security scan passes.

Written by the indexing model from the issue text.