Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/build.yml:
- Line 233: Update the version comment on the docker/login-action usage to
follow vX.Y.Z format: replace the existing comment "# v4" after the uses:
docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 with "# v4.1.0";
apply the same change for the other occurrence noted (the uses entry at the
other spot referenced in the review).

In @.github/workflows/gitops-update.yml:
- Around line 448-465: The current retry loop uses a linear backoff
(BACKOFF=$((i * 2))) causing 2,4,6... seconds; change it to exponential backoff
so waits grow like 1,2,4,8... (e.g. use BACKOFF as 2**(i-1) or equivalent)
inside the same for i in $(seq 1 $MAX_RETRIES) loop, optionally add a
MAX_BACKOFF cap variable and compute BACKOFF=min(2**(i-1), MAX_BACKOFF) before
the sleep and echo; keep the rest of the logic (git pull --rebase, git push,
error/exit) unchanged and reference MAX_RETRIES and BACKOFF variables.

---

Outside diff comments:
In @.cursor/rules/reusable-workflows.mdc:
- Around line 134-158: The example contains a conflicting workflow trigger:
remove the entire workflow_dispatch block (the "workflow_dispatch" key and its
nested inputs for "environment" and "dry_run") so the example only shows the
allowed "workflow_call" trigger and its inputs/secrets; ensure the remaining
YAML preserves the "workflow_call" inputs (environment, dry_run) and
DEPLOY_TOKEN secret without adding any workflow_dispatch entries.

In @.github/workflows/build.yml:
- Around line 293-295: The workflow's Docker metadata "tags" block no longer
emits the {{major}}.{{minor}} pattern but the docs still claim it's "Always"
available; either restore the tag pattern in the workflow or update the docs: to
restore, add a tags entry like
`type=semver,pattern={{major}}.{{minor}},value=${{ steps.version.outputs.version
}},enable=${{ needs.prepare.outputs.is_release }}` back into the `tags:` list in
.github/workflows/build.yml (alongside the existing `pattern={{version}}` and
`pattern={{major}}` entries), or remove the `{{major}}.{{minor}}` row from the
Docker Image Tags table in docs/build-workflow.md so the documentation matches
the current `tags` output.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.cursor/rules/reusable-workflows.mdc:
- Line 131: The rule prohibiting workflow_dispatch in reusable workflows creates
a breaking change because six existing reusable workflows (typescript-build.yml,
s3-upload.yml, release-notification.yml, labels-sync.yml, go-fuzz.yml,
branch-cleanup.yml) currently include it; update the rule text to require either
(a) an explicit exceptions list naming those six workflows with justification
and linkage to a documented gating pattern (see pr-security-scan.yml and the
github.event_name == 'pull_request' gating example) or (b) an action item to
migrate each listed workflow into a separate self-invoking workflow
`.github/workflows/self-*` per the rule, and add a short remediation checklist
and owner assignment so the non-compliance is tracked to completion.

In `@docs/build-workflow.md`:
- Line 227: The cosign verification regex in the --certificate-identity-regexp
option currently only matches refs/heads/* so tag-triggered workflows fail;
update the regexp used in the --certificate-identity-regexp argument to allow
both refs/heads/* and refs/tags/* (e.g., replace the current pattern that
contains refs/heads/ with a pattern that accepts refs/(heads|tags)/ or
refs/(?:heads|tags)/) so certificate identities from tag-triggered workflows
(refs/tags/<tag>) verify successfully.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/security/cosign-sign/README.md`:
- Line 49: The workflows build.yml and typescript-build.yml currently assemble
DockerHub image refs as REFS="${DOCKERHUB_ORG}/${APP_NAME}@${DIGEST}" which
violates the action.yml fully-qualified requirement; update the REFS
construction to prepend the docker registry prefix (e.g., set
REFS="docker.io/${DOCKERHUB_ORG}/${APP_NAME}@${DIGEST}" or use
${DOCKER_REGISTRY:-docker.io} to default) so the produced ref matches the
fully-qualified form expected by action.yml and README.md; alternatively, if you
prefer unqualified refs, update the action.yml input description to explicitly
allow unqualified refs instead of changing the workflows.

Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In @.github/workflows/build.yml:
- Around line 325-330: The GHCR_ORG value used when composing cosign refs must
be normalized to lowercase to match how images are named; update the step that
sets GHCR_ORG (the GHCR_ORG environment/value used when building REFS and cosign
references) so it lowercases a caller-supplied ghcr_org (e.g. use the same
normalization as steps.normalize.outputs.owner_lower or run a to-lower
transformation on inputs.ghcr_org) before composing the cosign signing refs,
ensuring GHCR_ORG and the pushed image names use identical lowercase host/org
values when enable_cosign_sign is enabled.