renderInvestigationAlerts already renders impostor-commit and
lockfile-forgery findings from the pin record. The hasUnfixable
gate then called PresentResults which re-rendered the same findings
from the checks report, producing duplicate output.

Pass those categories as excludeCategories to PresentResults so
they're skipped in the error findings block and summary line.

The hasUnfixable condition included impostor-commit, so
PresentResults still fired even with the exclude categories fix.
This produced a stale summary line counting pre-fix not-pinned
findings ("3 of 3 workflows failed: 6 not-pinned").

Split the gate: hasUnfixable still controls the allClean check and
errSilent return, but a narrower check (LocalAction and
SelfHostedRunner only) now controls the PresentResults call.

Look up the latest full semver tag for each repo and show it as a
concrete suggestion (e.g. '→ latest: v6.1.2'). Repos that have no
semver releases at all are suppressed from the nudge entirely, since
the advice to use full semver refs is not actionable for them.

Adds per-repo dedup via a map to avoid redundant API calls when
multiple entries share the same NWO.

When a dep is direct in one workflow but transitive in another (via
composite expansion), the transitive workflow's attribution was being
dropped from the 'Pinned N actions' output. The display code only
iterated Direct entries, so shared NWO@Ref groups never picked up
workflows from their transitive counterparts.

Add a second pass that merges workflow lists from transitive entries
into existing direct groups. Purely-transitive deps (no direct
counterpart) remain hidden.

Transitive deps discovered by composite expansion that have no direct
counterpart were invisible in the terminal output. This made it look
like the lockfile was missing deps when it was actually complete.

Now purely transitive deps appear dimmed at the end of the pinned list
with a 'via parent@ref' attribution. The header also shows the count:
'Pinned 3 actions (+ 1 transitive) across 3 workflows'.

Adds planWorkflow-level integration test confirming the full cross-ref
transitive closure (nested-composite@updated -> simple-composite@main
-> cross/dep@main) survives the plan pipeline.

When one ref in a batch fails (e.g. SSO 403 for actions/checkout),
the early return skipped the entire BFS loop. Transitive deps from
composite actions that DID resolve were never discovered, producing
an incomplete lockfile.

Accumulate errors across BFS iterations and return them after the
full traversal completes, so successful refs still get their
composite expansion.

When two workflows share a dep, the second Set call clobbered the
uses: list written by the first. A dep that is a transitive parent
in workflow A but a direct leaf in workflow B lost its uses: edges,
causing Save's GC to orphan-collect the transitive children.

Merge the incoming uses set with any existing entry's uses list so
edges from all workflows survive.

Diamond deps, depth-3 chains, direct+transitive overlap, cross-org
transitive deps, and the uses-merge clobber scenario in one golden
test. Verified it fails on the pre-fix code (composite-b loses its
uses:[leaf] when a second workflow's Set overwrites without merge).

Replaces the simpler SetMergesUsesAcrossWorkflows test.

Clones nodeselector/actions-test-fixtures and asserts the lockfile
contains the cross-repo transitive dep (fixtures-b@main) and uses:
chains. Catches both the BFS early-return bug and the Set clobber
bug in a single end-to-end assertion.

Also wires lockfile_contains from catalog into the test harness.

Replace loose lockfile_contains patterns with an exact golden file
comparison. The expected lockfile lives at
test/scenarios/testdata/transitive_closure_cross_repo.lock and the
harness diffs it byte-for-byte against the generated output.

Also adds lockfile_golden as a reusable catalog field for any future
scenario that needs exact lockfile verification.

The interactive shell's RESULT block now reports whether the golden
lockfile assertion passed or failed, matching the pattern used for
other expect checks.