[M] Audit external consumers pinned to v2

[cbeaulieu-gt]

Parent epic: #273 · Spec: docs/superpowers/specs/2026-05-20-codex-pivot.md §9 row 12, §11 (#M)

Scope

Survey post-release for repositories using glitchwerks/github-actions@v2 uses: pins. Notify each consumer of the breaking-change nature of v3 and the upcoming GHCR image deletions (#L).

Method

• GitHub dependency-graph search for uses: referencing glitchwerks/github-actions@v2 or @v2.x.x
• Cross-check via mcp__github__search_code for glitchwerks/github-actions in .github/workflows/** (acknowledge per feedback_github_code_search_false_negatives.md that this surface has known false-negatives — combine with direct enumeration of known consumer repos)
• Notify each consumer via GitHub Issue on their repo or direct comment on a relevant PR

Acceptance

• Audit report (consumer list + notification status) committed to docs/codex-pivot-consumer-audit.md or added as a comment on this issue
• Every consumer either notified or confirmed-defunct

Gating role

Audit completion gates the start of the 30-day GHCR-deletion grace window in #L. This decouples release timing from audit completion per §9 row 12 — the cutover can proceed against the OAuth deadline (~2026-06-20) without this becoming a release blocker.

🤖 Generated by Claude Code on behalf of @cbeaulieu-gt