6g. Re-capturing the AI recordings (recordings.yml)

A captured recording (captured: true under packages/ai/test/__recordings__) is what the model really said to the request on file. When the proposer's prompt or tools change, the request sent is no longer that one, and the replay says so. STALE_CAPTURES in packages/ai/test/recordings.ts lists the captures already found stale, each pinned to today's request. A stale capture is re-captured, never exempted, and never on a laptop or in an agent's session (DESIGN.md §17, decision 25). It is re-captured here:

1. Dispatch it. Go to Actions → recordings → Run workflow, from main. The job refuses any other ref. It has no inputs. Running it requires write access to the repository, as any workflow_dispatch does; that, and the main-only guard, is what stands in front of it, not an environment approval. It runs in the staging environment, as acceptance.yml does, for staging's secrets, and it reaches the API the way the deployed portal does. Its capture step holds staging's DIVVENT_OIDC_SIGNING_KEY and no other step does. The step signs an assertion and exchanges it as divvent:staging:portal. There is no API key anywhere. It runs live.test.ts's two recording tests (policy, onboarding) with DIVVENT_LIVE_AI=1. That is about two proposer calls, and the step summary says what they cost. A proposal that does not check out fails the run and uploads nothing.
2. Download the artifact. The run's recordings artifact holds onboarding.json and policy.json. It is kept for 14 days. Copy both over packages/ai/test/__recordings__/, and read the diff: captured: true, the model id, and the answer.
3. Commit. In the same commit, delete the two entries from STALE_CAPTURES so it is empty. A replay of a stale entry refuses to finish once every call matches, so the suite will not pass while an entry outlives its capture. Then run pnpm vitest run packages/ai acceptance. A test that sends one of these recordings a different request fails and names the request (ask.test.ts has sent onboarding a conversation prompt, and a claude-opus-5 model id). That test needs a recording of its own, or a synthesised fixture that says it is one. Do not repin it, and do not add it back to STALE_CAPTURES.

The workflow never commits or pushes. It asks only for contents: read, and its checkout leaves no token behind. workflow-stages.test.ts holds it to that. It also holds acceptance.yml's job guard and environment, the secret on one step, the absence of inputs, and the artifact's paths. Those paths are the recordings live.test.ts writes, and every entry in STALE_CAPTURES must be one of them.