ci(pdf): vendor generation 21 policy

[willgriffin]

Generation 21 promoted 2026-07-30 06:10Z (channel revision 24, happyvertical/.github#103). The managed AGENTS.md block on main carried kernel 9a4cf725…, which predates both kernels that generation ships, so every agent-authored pull request failed Agent Policy / lifecycle — including PRs touching nothing but .github/workflows/.

This regenerates the block from the generation-21 diagnostic kernel (2524e6ee…), the one this repository's runtime.agent_lifecycle_stage: diagnostic selects.

What changed

AGENTS.md only — the bytes between the hv-managed-policy markers. The block is generated output: the kernel's - bullets under a ## Shared development kernel heading. Nothing outside the markers moved, and no other file changed.

Generated with the control-plane hv-agent migrate-repo, not hand-edited.

Verification

Auditing this branch with the pinned generation-21 artifact — the same tool CI runs:

$ hv-agent audit .
Agent Policy / lifecycle passed

Before the change, the same command on origin/main reported:

ERROR AGENTS.md: stale or edited managed policy block
ERROR AGENTS.md: generated policy block was edited

Context

Part of happyvertical/.github#105, which covers the same drift class in sdk, pdf, and happyvertical.com.

{
  "schema": "hv-agent-run:v1",
  "runtime": "claude",
  "session": "dd233d07-ae14-43c0-bfec-b4f99514936a",
  "issue": "123",
  "policy_revision": "1.0.0",
  "validation": [
    "hv-agent audit . with pinned generation-21 artifact sha256:a19abb22 - clean",
    "hv-agent check-pr - Agent Policy / lifecycle passed"
  ]
}

Closes #123

[github-actions]

Release Preview

This PR title will not trigger an automatic release on squash merge.

Use a releaseable conventional PR title like fix(pdf): ..., feat(pdf): ..., or chore(deps): ... if this change should publish automatically.

Otherwise, add a manual changeset or apply the skip-changeset label if no release is needed.