Function generate_workflow 

pub fn generate_workflow(config: &WorkflowConfig) -> GeneratedWorkflow

Generate a deterministic GitHub Actions workflow.

The compile job has no environment and no secrets expressions. The sign job receives the bounded exact configured signing-secret set at its worker invocation, after the sealed archive is downloaded and independently hash-checked. It never checks out or builds project source and always invokes worker cleanup.