repair(automation): remove stale self-modifying hourly NIM writer #752

Finding

The live fix/analysis-result-validation-status-638 branch still carries .github/workflows/hourly-nim-product-development.yml, a purpose-complete repository writer that launches an agent, applies its generated patch, pushes a new branch, and creates a pull request. That is no longer an admissible TEPP automation boundary under the current CWL contract.

The same workflow also provisions BYTEZ/NVIDIA_NIM(_SUB)/OPENROUTER/OPENAI provider credentials directly and configures OpenCode against a caller-local contextual-orchestrator/contextual-orchestrator model. The current canonical .github owner instead documents model-backed GitHub work through the contextual-orchestrator orchestrator/free pool, with provider discovery/routing owned by contextual-orchestrator rather than the product repository.

This is not a transient queued-run problem. The workflow source itself has stale authority and can recreate source changes/PRs outside the current single-writer loop when its zero-open-work gate becomes true.

Required repair

• remove .github/workflows/hourly-nim-product-development.yml from TEPP rather than replacing it with another purpose-complete self-modifying workflow;
• do not copy provider discovery, provider keys, model/group selection, or paid fallback policy into a replacement TEPP workflow;
• if a future model-backed Actions caller is needed, consume the canonical .github reusable/exact-SHA contract and orchestrator/free gateway boundary instead of recreating the gateway in TEPP;
• preserve the existing Rust/security/docs required workflows and the external TEPP commercial-development scheduler;
• record the removal in CHANGELOG and fix(release): bind fail-closed reconstructable topic-lineage results (#638) #639 authority without treating it as scientific acceptance, a 10,000-DGP run, or a release.

Evidence

The stale workflow contains both git apply --index --binary and a later git push ... / gh pr create ... publication path. Its environment and sidecar bootstrap also pass the five provider secrets directly. Current ContextualWisdomLab/.github protected-main documentation assigns provider discovery/capability routing and orchestrator/free to contextual-orchestrator.

Refs #639 #680 #751.