docs: correct v2.3.0 pin and attestation fallback

[jadoonf]

Summary

• Correct the exact v2.3.0 SHA pin to 245ad6be82de3200c205109c8ca7ac816dc692ea.
• Qualify the scoped-egress attestation wording: verification runs when github_token and gh are available; otherwise the Action warns and skips attestation verification.

Validation

• npm ci — passed.
• npm run validate — failed in test/terminal-run.test.js: exec.exec is not a function (100 passed, 1 failed); no runtime files were changed.
• npm run typecheck — passed.
• npm run build — passed; final diff is README-only.

---

Note

Low Risk
README-only changes with no runtime or workflow behavior modified.

Overview
Documentation-only updates to match how the Action actually behaves and to fix a wrong release pin.

The Scoped egress bullet now states that Jibril release attestation via gh attestation verify runs only when github_token and the gh CLI are available; otherwise the Action warns and skips attestation (checksum verification is still described as part of the flow).

The pinning example for v2.3.0 is corrected from SHA f9ed14ab… to 245ad6be82de3200c205109c8ca7ac816dc692ea.

^{Reviewed by Cursor Bugbot for commit 2aa21b7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[strix-security]

Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here.

So far, Strix has reviewed 13 pull requests and surfaced 1 security issue across this workspace.

[garnet-runtime-review]

Execution Profiles recorded for 1 job, triggered by 2aa21b7

6 destinations
_{recorded at the kernel by Garnet · 2026-10-02 19:45 UTC}

CI / build-and-verify ↗ · 6 destinations

Runner.Worker
├─ node
│  └─ ○ api.github[.]com
└─ bash
   └─ node (step: "Install dependencies")
      ├─ ○ localhost (dns resolver)
      └─ ○ registry.npmjs[.]org

systemd
├─ python3.12
│  └─ python3.12
│     └─ ○ 168.63.129.16
├─ hosted-compute-agent
│  └─ sudo
│     └─ provjobd (ran from /tmp/…)
│        └─ ○ hosted-compute-watchdog-prod-iad-01[.]githubapp (github infra)
└─ systemd-networkd
   └─ ○ ip6-allrouters

_{View this job's Execution Profile in Garnet →}

---

_{💡 How to read this}

Runner.Worker          ← process on a path
└─ npm
   └─ node             ← process that acted
      └─ ○ npmjs[.]org ← observed action

_{follow a path downward to see what ran and what it did — each path to an observed action is an execution chain}

_{names on the path = processes · ○ = observed action · (…) = context}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.