fix: harden reusable drift trust boundaries

[Pigbibi]

Summary

• lock reusable drift runs to trusted callers and immutable workflow sha
• require explicit snapshot checkout credentials for private cross-repo pipelines
• preserve backtest param_version when persisting existing results

Validation

• PYTHONPATH=src python3 -m pytest -q tests/test_backtest_orchestrator.py tests/test_reusable_drift_workflow.py tests/test_strategy_performance_export.py tests/test_validate_strategy_evidence_package.py tests/test_param_optimizer.py tests/test_lifecycle_cli.py tests/test_lifecycle_doctor.py tests/test_update_orchestrator.py tests/test_lifecycle_drift.py

[github-actions]

🤖 Codex PR Review

🚫 Merge blocked: 1 serious issue(s) found in high-risk files

🚫 Blocking Issues

These issues must be fixed before this PR can be merged:

1. 🟠 [HIGH] Bug in .github/workflows/reusable-drift-check.yml

The reusable workflow now checks out QuantStrategyLab/QuantPlatformKit at ${{ github.workflow_sha }}, but in reusable workflows github.workflow_sha is the SHA of the caller's workflow file, not the SHA from the reusable workflow repository. For callers like QuantStrategyLab/CnEquityStrategies, this SHA will usually not exist in QuantStrategyLab/QuantPlatformKit, so actions/checkout will fail and the drift job will stop before any validation or analysis runs. (line 130)

Suggestion: Use the reusable workflow identity when checking out co-located source, e.g. repository: ${{ job.workflow_repository }} with ref: ${{ job.workflow_sha }}, or otherwise resolve a ref that is guaranteed to exist in QuantStrategyLab/QuantPlatformKit instead of using github.workflow_sha.

---

Review by Codex PR Review bot • PR