[rmcdaniel]

Part of #295. Third step of the staged change: #374 merged, then this PR, then #373. It's the same one-line pattern as #365 and #366.

native-policy.yml checks out the reviewer at a pinned ref and reads the reviewed-bytes registry from it. The pin is still 4ad153a3, the merge of #364, which predates #374. So Validate native policy subject keeps refusing #373 (run 43368725978): Protected pilot requires closed literal commands or exact reviewed workflow bytes.

Change: one line. The reviewer checkout ref moves from 4ad153a3… to 114ad7dc84e43661a1a667dcf21c6b3f60117b6c, the merge of #374.

What else moves with the ref (4ad153a3..114ad7dc, files under scripts/ and qualification/):

• protected_policy_context.py: +7 lines, the Register the no-retries CI and Sonar workflow bytes #374 registry entry.
• php_linux_upstream_pins.py: new file from Check daily that pinned php-ubuntu assets are still published (#358) #369, not used by the native check.
• qualification/php-linux-bootstrap.json removed and README.md edited, from Pin only the PHP archives setup uses #371.
• native_policy_check.py, qualification_policy.py and qualification/requirements.lock are unchanged.

Checked locally against 114ad7d's protected_policy_context.validate_context:

• Disable APT retries before setup-php in CI and Sonar #373's ci.yml and sonar.yml (head db27d1c8) are accepted.
• This PR's native-policy.yml is accepted as closed literal commands.

This PR's own run of the check uses the new ref, because pull_request runs the workflow from the PR. After it merges, re-run #373's check.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security PASS at bb9ef6b (CI 9 green). One line: the native-policy.yml checkout ref moves from 4ad153a to 114ad7d, the #374 merge. In scripts/ and qualification/, the range brings in only already-reviewed changes: #374's registry entry, #369's php_linux_upstream_pins.py (unused by the native check) and #371's removal of php-linux-bootstrap.json plus a README edit. native_policy_check.py, qualification_policy.py and the requirements lock are unchanged. OK to merge, then re-run #373.