DL-447

Renovate PRs that move a nix-built tool get two advisory workflows (not ci.yml, never required): a read-only pull_request workflow collects an eval-only direct-package diff plus a transitive closure diff as JSON, and a workflow_run workflow from the default branch validates that untrusted artifact, renders it, and writes it best-effort after a  marker with pull-requests: write. Each devenv.lock and agent-image/devenv.lock packageRule sets a commitMessageTopic naming what moves and where.

Status: Active (Matt, 2026-10-10)

Record: ../../repo/compass-renovate-nix-pr-bodies/design.md#approach