chore: add orb setup and pin CI checkout

[undivisible]

Summary

• Add executable .agents/setup and .agents/resume so Amp orbs install MSRV 1.88 + stable Rust, AT-SPI/D-Bus headers, OpenClaw bun deps, and Hermes ruff/ty.
• Ignore .amp/portals/*.
• Pin actions/checkout to 11d5960a326750d5838078e36cf38b85af677262 (v4.4.0) in every CI job.
• Run cargo clippy -D warnings on the MSRV job so 1.88 lints cannot regress (CI rust matrix uses stable, which currently does not emit this lint).
• Inline format!("{process_generation}-stale") in a CDP invalid-config test.

Audit notes (no extra PRs)

Jules PRs #1–#52 are merged or recovered via #51. No open PRs/issues. Security boundaries (library-only execute, DenyAuthority CLI, fenced targets, loopback CDP + PID ownership, host-injected Ed25519) look intact. Not auto-merging: CI/control-path change. No crates.io publish.

Test plan

• .agents/setup cold ~42s, warm ~2s; .agents/resume <1s
• cargo fmt --all -- --check
• cargo clippy --locked --all-targets --all-features -- -D warnings on 1.88 and stable
• cargo test --locked --all-features (170 tests)
• OpenClaw bun format/lint/typecheck/test/build
• Hermes test_plugin.py + ruff

---

Note

Low Risk
Mostly dev-environment and CI workflow changes; MSRV clippy may surface new build failures but does not alter runtime security paths.

Overview
Adds Amp orb bootstrap via executable .agents/setup (system deps, Rust 1.88 + stable with fmt/clippy, cargo fetch, optional OpenClaw bun install, Hermes dev venv) and .agents/resume (fast toolchain presence checks). Ignores .amp/portals/* in git.

CI pins actions/checkout to commit v4.4.0 across jobs and runs cargo clippy -D warnings on the MSRV 1.88 job so lints that stable might miss still fail on minimum Rust.

One test-only tweak in cdp.rs: inline format!("{process_generation}-stale") in an invalid-config assertion.

^{Reviewed by Cursor Bugbot for commit d5a946a. Configure here.}

[capy-ai]

Capy couldn't review this pull request because Max's workspace is out of credits, add credits or enable auto-reload to resume automatic reviews.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_73633dd8-9617-424a-940a-35ebf2ee09cd)