ci(issue-code): prewarm build cache via ./build-fast.sh; enforce protected-path policy against agent commits; prefer GH_PAT for push/PR if available

.github/workflows/issue-code.yml

@@ -119,6 +119,14 @@ jobs:
             codex-rs -> target
           save-if: true
 
+      - name: Prime Rust build cache (fast local build)
+        shell: bash
+        env:
+          STRICT_CARGO_HOME: "1"
+        run: |
+          set -euo pipefail
+          ./build-fast.sh
+
       - name: Prepare agent workspace files
         env:
           ISSUE_NUMBER: ${{ steps.meta.outputs.issue_number }}
@@ -270,7 +278,13 @@ jobs:
           PROTECTED_GLOBS: ${{ env.PROTECTED_GLOBS }}
         run: |
           set -euo pipefail
+          # Collect changes in working tree
           mapfile -t files < <(git diff --name-only)
+          # If agent committed, include committed file list since BASE_HEAD as well
+          if [ "${{ steps.changes.outputs.agent_committed }}" = "true" ] && [ -n "${BASE_HEAD:-}" ]; then
+            mapfile -t committed < <(git diff --name-only "$BASE_HEAD..HEAD" || true)
+            files+=("${committed[@]}")
+          fi
           if [ ${#files[@]} -eq 0 ]; then echo "ok=true" >> "$GITHUB_OUTPUT"; exit 0; fi
           mapfile -t patterns < <(printf '%s\n' "$PROTECTED_GLOBS" | sed '/^\s*$/d')
           violations=()
@@ -282,13 +296,16 @@ jobs:
       - name: Create branch, commit, push
         if: steps.changes.outputs.changed == 'true' && steps.path_policy.outputs.ok != 'false'
         env:
-          GH_TOKEN: ${{ secrets.CODE_GH_PAT }}
+          GH_TOKEN: ${{ secrets.GH_PAT || secrets.CODE_GH_PAT }}
           ISSUE_NUMBER: ${{ steps.meta.outputs.issue_number }}
           ISSUE_TITLE: ${{ steps.meta.outputs.issue_title }}
         run: |
           set -euo pipefail
           # Use bot identity if available
-          if [ -n "${{ secrets.CODE_GH_PAT }}" ]; then
+          if [ -n "${{ secrets.GH_PAT }}" ]; then
+            git config user.name "just-every-code"
+            git config user.email "[email protected]"
+          elif [ -n "${{ secrets.CODE_GH_PAT }}" ]; then
             git config user.name "just-every-code"
             git config user.email "[email protected]"
           else
@@ -314,7 +331,7 @@ jobs:
         id: open_pr
         uses: actions/github-script@v7
         env:
-          PAT: ${{ secrets.CODE_GH_PAT }}
+          PAT: ${{ secrets.GH_PAT || secrets.CODE_GH_PAT || secrets.GITHUB_TOKEN }}
         with:
           github-token: ${{ env.PAT || secrets.GITHUB_TOKEN }}
           script: |