feat(lanes): pass the transcript key to the reusable review and intake legs

.github/actions/resolve-config/callers.test.mjs

@@ -7536,6 +7536,18 @@ test("every model leg is followed by a sealed transcript upload of its own execu
   assert.ok(legs >= 13, `only ${legs} model legs found`);
 });
 
+test("every caller of a reusable holding model legs passes the transcript key", () => {
+  let callers = 0;
+  for (const file of workflowFiles()) {
+    for (const [jobId, job] of Object.entries(workflow(file).jobs ?? {})) {
+      if (!/\/ci-workflows\/\.github\/workflows\/(pr-review-cli|intake-triage)\.yml@/.test(String(job.uses ?? ""))) continue;
+      callers++;
+      assert.equal(job.with?.["lane-transcript-public-key"], "${{ vars.LANE_TRANSCRIPT_PUBLIC_KEY }}", `${file}#${jobId}`);
+    }
+  }
+  assert.ok(callers >= 3, `only ${callers} callers found`);
+});
+
 // request-lane-token's kill-switch-ok ends a kill-switch refusal green with no
 // token, so nothing after it may run on success() alone: every later step is
 // gated, a step that reads the token runs only when it is set, and a job that

.github/workflows/intake-triage.yml

@@ -260,6 +260,7 @@ jobs:
       runner: ubuntu-24.04
       role: intake
       claude-args: ${{ needs.born-triaged.outputs.claude-args }}
+      lane-transcript-public-key: ${{ vars.LANE_TRANSCRIPT_PUBLIC_KEY }}
       issue-number: ${{ inputs.issue-number }}
       allowed-author-ids: ${{ needs.born-triaged.outputs.human-ids }}
       allowed-bot-sender-ids: ${{ needs.born-triaged.outputs.bot-ids }}

.github/workflows/pr-review-hosted.yml

@@ -221,6 +221,7 @@ jobs:
     with:
       lane: code
       publish: comments
+      lane-transcript-public-key: ${{ vars.LANE_TRANSCRIPT_PUBLIC_KEY }}
       # Empty unless resolve-model succeeded, so a failed job's partial output
       # never reaches the review.
       model-args: ${{ needs.resolve-model.result == 'success' && needs.resolve-model.outputs.claude-args || '' }}

.github/workflows/pr-review-security-hosted.yml

@@ -226,6 +226,7 @@ jobs:
     with:
       lane: security
       publish: comments
+      lane-transcript-public-key: ${{ vars.LANE_TRANSCRIPT_PUBLIC_KEY }}
       # Empty unless resolve-model succeeded, so a failed job's partial output
       # never reaches the review.
       model-args: ${{ needs.resolve-model.result == 'success' && needs.resolve-model.outputs.claude-args || '' }}