Harden production workflows and agent admission

.github/workflows/ci.yml

@@ -17,8 +17,16 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: "22"
+          # PH-021: cache npm so the pinned @redocly/cli version below is fetched
+          # once per cache hit; the version is pinned by exact tag in this file
+          # so the same artifact is used across runs.
+          cache: npm
+          cache-dependency-path: web/package-lock.json
       - name: Lint OpenAPI
-        run: npx --yes @redocly/cli@1.34.6 lint api/openapi.yaml
+        # PH-021: @redocly/cli is not in package.json because it is a lint-only
+        # tool that does not ship with the web bundle. The exact version below
+        # is the reproducibility pin; do not float to "latest" or a range.
+        run: npx --yes @redocly/cli@2.11.1 lint api/openapi.yaml
 
   agent:
     runs-on: ubuntu-latest