composite actions in .github/actions are not covered by the actions.toml pin registry and have already drifted

.github/ci/actions.toml is meant to be the pin registry that every workflow pulls its action versions from. It is enforced by scripts/ci/generate_workflows.py and checked in the ci generation check workflow, but that check only regenerates policy-engine-ci.yml. It never looks at the two composite actions under .github/actions.

Those composite actions already pin different, older versions than the registry. contributor-check/action.yml pins actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 which is v5.6.0, while the registry currently pins v6.2.0. ai-agent-runner/action.yml pins actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 which is v4.4.0, while the registry pins v6.4.0.

So the registry is not actually the single place these versions live. These two files drifted silently and nothing caught it.

Suggested fix: either extend the generator and its check so it also validates composite action pins against the registry, or document that composite actions are intentionally out of scope and update them by hand whenever the registry changes.

Steps to reproduce

Grep .github/actions for actions/setup-python@ and actions/setup-node@ and compare the SHAs and version comments against .github/ci/actions.toml.

Read .github/ci/actions.toml, scripts/ci/generate_workflows.py, and the CI generation check workflow, then inspect .github/actions/contributor-check/action.yml and .github/actions/ai-agent-runner/action.yml. Compare the setup-python and setup-node pins with the registry. Done means the composite action pins are validated by the check or their intentional exclusion and manual-update process is documented.