ci: require agentcompat stress validation

Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>

integration/agentcompat/internal/workflowpolicy/testdata/secure-resolved-ref.yml

@@ -0,0 +1,27 @@
+name: Secure resolved ref
+on:
+  pull_request:
+concurrency: resolved-${{ github.ref }}
+permissions:
+  contents: read
+jobs:
+  verify:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - id: resolve-agent
+        name: Resolve Agent commit
+        shell: bash
+        run: |
+          set -euo pipefail
+          remote='https://github.com/nezhahq/agent.git'
+          mapfile -t refs < <(git ls-remote "$remote" refs/heads/main)
+          (( ${#refs[@]} == 1 ))
+          sha=${refs[0]%%$'\t'*}
+          [[ "$sha" =~ ^[0-9a-f]{40}$ ]]
+          printf 'sha=%s\n' "$sha" >> "$GITHUB_OUTPUT"
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        with:
+          repository: nezhahq/agent
+          ref: ${{ steps.resolve-agent.outputs.sha }}
+          persist-credentials: false