agents: require local setup-bazel composite action in workflows (#4290)

Invoking `bazel-contrib/setup-bazel` directly in workflows bypasses the
project's `.github/actions/setup-bazel` wrapper and its caching and
`.bazelrc` defaults.

Update the workflow rule and code review auditor prompts to require
`uses: ./.github/actions/setup-bazel` (and updating the composite action
when defaults or inputs need adjustment).

.agents/rules/github_actions_workflows.md

diff --git a/.agents/rules/github_actions_workflows.md b/.agents/rules/github_actions_workflows.md
index 6d39724..dfec2b0 100644
--- a/.agents/rules/github_actions_workflows.md
+++ b/.agents/rules/github_actions_workflows.md
@@ -1,12 +1,18 @@
 ---
 name: github-actions-workflows
 trigger: glob
-globs: ".github/workflows/**"
+globs: ".github/workflows/**,.github/actions/**"
 ---
 
 # GitHub Actions Workflows Rule
 
 * Use the latest version of referenced actions in `.github/workflows/`.
+* **Use Local Composite Actions (`./.github/actions/setup-bazel`)**: Always use
+  local composite action wrappers (such as
+  `uses: ./.github/actions/setup-bazel`) instead of invoking upstream actions
+  like `bazel-contrib/setup-bazel` directly in `.github/workflows/`. Update
+  `.github/actions/setup-bazel/action.yaml` if project defaults or inputs need
+  adjustment.
 * Preserve `suppress-no-jobs-ran-error` fallback jobs in conditional workflows.
 * Pass inputs (e.g. `${{ inputs.issue }}`) directly to commands without
   redundant shell stripping.

.agents/skills/review-code/SKILL.md

diff --git a/.agents/skills/review-code/SKILL.md b/.agents/skills/review-code/SKILL.md
index 03236e4..ca84ccd 100644
--- a/.agents/skills/review-code/SKILL.md
+++ b/.agents/skills/review-code/SKILL.md
@@ -59,7 +59,8 @@
      `.agents/skills/review-code/review-workflows-prompt.md`
    - Focus: Audits workflow files (`.github/**`) and workflow tests against
      `.agents/rules/github_actions_workflows.md` (e.g. `chmod +x` executable
-     permissions, shebangs, action versions, fallback jobs).
+     permissions, shebangs, action versions, `./.github/actions/setup-bazel`
+     wrapper usage, fallback jobs).
 
 8. **`rules_python` Usage Sub-Agent** (`Role: "rules_python Usage Auditor"`):
    - Prompt file:

.agents/skills/review-code/review-workflows-prompt.md

diff --git a/.agents/skills/review-code/review-workflows-prompt.md b/.agents/skills/review-code/review-workflows-prompt.md
index afec077..4543704 100644
--- a/.agents/skills/review-code/review-workflows-prompt.md
+++ b/.agents/skills/review-code/review-workflows-prompt.md
@@ -1,7 +1,7 @@
 You are a specialized GitHub Actions & Workflows Auditor sub-agent.
-Your sole task is to audit all workflow files (`.github/workflows/**`) and
-workflow test changes in `git diff` against the project's workflow rules and
-conventions:
+Your sole task is to audit all workflow files (`.github/workflows/**`,
+`.github/actions/**`) and workflow test changes in `git diff` against the
+project's workflow rules and conventions:
 
 1. Read and strictly enforce `.agents/rules/github_actions_workflows.md`,
    `AGENTS.md`, and `CONTRIBUTING.md`.
@@ -25,5 +25,12 @@
    inlined in workflow YAML steps (`run: |`), shell scripts, or command
    invocations via heredocs (`<< 'EOF'`) or `-c` flags (`bash -c`,
    `python3 -c`).
+9. Verify local composite actions: ensure workflows use local composite action
+   wrappers (specifically `uses: ./.github/actions/setup-bazel`) rather than
+   invoking `bazel-contrib/setup-bazel` directly. If a workflow calls
+   `bazel-contrib/setup-bazel` directly, replace it with
+   `uses: ./.github/actions/setup-bazel` (updating
+   `.github/actions/setup-bazel/action.yaml` if new defaults or inputs are
+   needed).
 
 @.agents/skills/review-code/review-report-format.md