Read the shared-instruction pin from .agents (#42)

.agents/instructions.toml

@@ -0,0 +1,6 @@
+# What this repository carries from aicers/agent-instructions: the release
+# it is on, and the shared blocks it has. Its drift check reads this file,
+# and its apply job rewrites it. Which blocks a repository should carry is
+# decided upstream in repos.json, not here.
+ref = "v2"
+blocks = ["workflow", "rust"]

.github/workflows/ci.yml

@@ -29,15 +29,19 @@ jobs:
 
   # Ungated and unconditional, like Markdown: AGENTS.md is itself Markdown,
   # so a documentation-only change is exactly the change that can edit a
-  # generated region. Pinned to a release tag rather than a branch, so an
-  # edit upstream reaches this repository through its sync pull request
-  # instead of turning every unrelated pull request red.
+  # generated region.
+  #
+  # No `with:` block. The release to compare against and the blocks to
+  # compare are both read from `.agents/instructions.toml`, so they have
+  # one source rather than two that can disagree, and the apply job that
+  # rewrites them never has to touch `.github/workflows/` -- which the
+  # default GITHUB_TOKEN may not push to. The pin is a release tag rather
+  # than a branch, so an edit upstream reaches this repository through the
+  # pull request that moves it instead of turning every unrelated pull
+  # request red.
   instructions:
     name: Instructions
     uses: aicers/agent-instructions/.github/workflows/check-drift.yml@main
-    with:
-      blocks: "workflow rust"
-      instructions-ref: v2
 
   check:
     runs-on: ubuntu-latest