Function render_workflow 

pub fn render_workflow(cfg: &VgiConfig, checkout_action: &str) -> String

The workflow committed to the repository (outside a required-workflow namespace). Differs from the dormant one in the runbook: there is no if: vars.TRUST_REGISTRY_DID != '' guard (a skipped required job counts as passing), and the DIDs are literals rather than vars.*, which any repository admin could change.