Validate plaintext Cast validator in the gh-aw test zone

[bradygaster]

Outcome

Prove the plaintext Cast validator works end-to-end in octodemo/zava-social-squad-backend after the implementation issue lands on Squad dev.

Dependency

Blocked by #1984.

Time box

Maximum validation effort: 1 hour. Stop and capture exact run evidence on failure; do not patch Squad or the consumer repository during this validation issue.

Test procedure

1. Install or update the four Squad workflows from bradygaster/squad/...@dev in the Zava test repository.
2. Review the resulting consumer PR and confirm the validator is plaintext under .github/workflows/shared/, with no Base64 Cast payload or experimental probe remaining.
3. Strictly compile the installed workflows and merge the human-reviewed setup/update PR.
4. Rerun /squad cast on the existing Cast issue.
5. Confirm the runtime validator executes from $GITHUB_WORKSPACE, the workflow succeeds, and a linked Cast PR is delivered.
6. Confirm the Cast PR contains only the expected team artifacts and remains human-reviewed.

Acceptance criteria

• Fresh/update transport succeeds.
• Runtime SHA-256 and validator execution succeed across the agent sandbox boundary.
• The Cast workflow concludes successfully and links a Cast PR.
• No CLI/SDK installation or package behavior is involved.
• Run, setup/update PR, and Cast PR links are recorded on this issue.

Failure handling

If any step fails, record the failing stage, exact stderr, workflow run, and observed installed paths. Do not broaden scope; file a narrowly scoped follow-up.