CI hygiene: de-instance firewall comments + bump v2/v1 action stragglers

[Jammy2211]

Two tiny items from the 2026-07-30 CI/release audit (series tasks 6+7):

1. Clear the standing manifest drift: tenant firewall — 2 mismatches: autohands/generate.py:66 and tests/test_generate_validates_project.py:6 name autocti_workspace in incident-narration comments (the 113-notebook deletion story). The repo IS registered in repos.yaml — the firewall flags instance facts in unlisted organ-code files, and its allowlist doctrine says never grow it casually. Fix: de-instance the two comments ("an unregistered workspace"); the specifics live in git history and fix: generate.py deletes notebooks/ before validating the project name #215.
2. Action stragglers: the fleet is uniformly on checkout@v4 / setup-python@v5 / upload-artifact@v4 except release.yml (checkout@v2 + setup-python@v2 in the release_workspaces / bump_library_colab_urls area) and the two JOSS draft-pdf.yml files in PyAutoCTI + PyAutoGalaxy (checkout@v2 + upload-artifact@v1 — v1 is past end-of-life, so those jobs are likely already broken). Purely mechanical version bumps, no step-logic changes; the nightly rehearsal exercises release.yml tonight.

PRs: one here (both items), one each in PyAutoCTI and PyAutoGalaxy referencing this issue.
Prompts: PyAutoMind/active/register_autocti_workspace_clear_manifest_drift.md, active/action_version_stragglers_v2_v1.md

[Jammy2211]

Implemented — four PRs open, awaiting human merge (any order; all independent):

1. PyAutoHands#218 — comment de-instance + release.yml v2→v4/v5 bumps (suite 258 passed)
2. Bump draft-pdf actions to fleet standard PyAutoCTI#102 — draft-pdf bumps
3. Bump draft-pdf actions to fleet standard PyAutoGalaxy#539 — draft-pdf bumps (disjoint from the in-flight plot-guides-restructure claim)
4. De-instance fixture paths in test_worktree_drift (tenant firewall) PyAutoHeart#125 — test-fixture de-instance (the firewall, re-run over the audit's own output, caught the new feat: Colab maturity — generated setup cells, setup_colab registry, URL guards #124 test file; suite 328 passed)

Also landed directly in PyAutoMind (d8dc28e): the firewall allowlist entry renamed worktree_drift.sh → .py following the #124 refactor.

Verified end-state: repos_sync.check_tenant_firewall over a symlink farm of all four edited repos returns NONE — the standing manifest drift: tenant firewall — 2 mismatch(es) readiness YELLOW clears on the first tick after these merge.