ci: report agent drift and fix macOS lock race

internal/factory/change.go

@@ -206,7 +206,16 @@ func (s *ChangeStore) lockChange(changeID string) (func(), error) {
 		return nil, err
 	}
 	defer root.Close()
-	lock, err := root.OpenFile(changeID+".lock", os.O_CREATE|os.O_RDWR|syscall.O_NOFOLLOW, 0600)
+	var lock *os.File
+	for attempt := 0; ; attempt++ {
+		lock, err = root.OpenFile(changeID+".lock", os.O_CREATE|os.O_RDWR|syscall.O_NOFOLLOW, 0600)
+		if err == nil || !errors.Is(err, os.ErrNotExist) || attempt == 4 {
+			break
+		}
+		// Concurrent first opens can briefly see ENOENT on macOS while another
+		// worker creates the lock file. Retry only that transient condition.
+		time.Sleep(time.Duration(attempt+1) * time.Millisecond)
+	}
 	if err != nil {
 		return nil, err
 	}

scripts/check-agent-updates.py

@@ -1,7 +1,8 @@
 #!/usr/bin/env python3
-"""Report upstream agent releases that need a separate compatibility review."""
+"""Report upstream agent releases needing compatibility review as warnings."""
 
 import json
+import os
 from pathlib import Path
 import sys
 from urllib.request import Request, urlopen
@@ -28,8 +29,18 @@ def main():
         if version != pinned[agent]:
             changed = True
     if changed:
-        print("A compatibility-sensitive agent update needs qualification and new hashes.", file=sys.stderr)
-        return 1
+        message = (
+            "An upstream agent release needs compatibility review and new hashes; "
+            "qualified pins were left unchanged. See the step log for version details."
+        )
+        print(f"::warning title=Agent update needs qualification::{message}")
+        summary_path = os.environ.get("GITHUB_STEP_SUMMARY")
+        if summary_path:
+            with open(summary_path, "a", encoding="utf-8") as summary:
+                summary.write(
+                    "### Agent update needs qualification\n\n"
+                    f"{message}\n"
+                )
     return 0