[github-actions]

Automated RustCFML engine bump (daily version check).

Pinned v0.730.0 → v0.732.0.

The full core suite ran green against the new engine, so this PR
bumps tools/rustcfml/ENGINE_VERSION and the per-asset sha256 pins in
tools/rustcfml/ENGINE_SHA256 (from the release's published digests),
plus the CLI's copies of both in
cli/lucli/services/rustcfml/RustCFMLEngine.cfc, and regenerates
tools/rustcfml/baseline.json to the new engine's result set.

If the suite had shown new failures, the pin would have been left
unchanged and this PR would not exist.

[github-actions]

Wheels Test Results

0 tests   - 260 610   0 ✅  - 254 873   0s ⏱️ - 1h 58m 40s
0 suites  -  20 965   0 💤  -   5 737 
0 files    -      35   0 ❌ ±      0 

Results for commit 894d9ed. ± Comparison against base commit 9fcc17c.

[bpamiri]

Review: REQUEST CHANGES. The branch was reset by the bot after the cleanup. The pin itself is right.

What happened

I reviewed 894d9ed (the bot bump, plus the follow-up that removed the run artifacts and refreshed baseline.json _notes[0]). At 18:08Z, another version-check run's peter-evans/create-pull-request step force-replaced auto-bump/rustcfml-v0.732.0 with a fresh single commit, 6b9e4e2. 894d9ed is no longer an ancestor of the head. The new head:

• re-adds the artifacts: public/logs/*.log (8 files, about 5,800 lines) and tools/ci/__pycache__/testbox_results.cpython-312.pyc;
• reverts the _notes[0] refresh (it again describes the v0.693.0 run, 5850/29);
• has no CI: it's a bot push with GITHUB_TOKEN, so gh pr checks reports "no checks" and the merge state is BLOCKED.

Root cause, so it doesn't recur

.github/workflows/rustcfml-version-check.yml → "Open bump PR" uses peter-evans/create-pull-request with no add-paths, so it commits everything the suite left in the working tree. Neither public/logs/ nor __pycache__/ is gitignored. And because the action re-creates the branch on each run while the PR is open, any manual fix-up on the branch gets overwritten.

• Add add-paths: to that step, limited to tools/rustcfml/ENGINE_VERSION, tools/rustcfml/ENGINE_SHA256, tools/rustcfml/baseline.json and cli/lucli/services/rustcfml/RustCFMLEngine.cfc; and/or gitignore public/logs/*.log and **/__pycache__/.
• Re-apply the cleanup on this branch (drop the logs and the .pyc, refresh _notes[0]) after that's in place, or close this PR and let the next run open a clean one.

Verified (unchanged by the reset)

• sha256 pins in ENGINE_SHA256 and RustCFMLEngine.cfc equal the published digests of the v0.732.0 release assets (linux-aarch64 e21978e4…, linux-x86_64 f3d893bf…, macos-aarch64 c84ed045…). ENGINE_VERSION, engineVersion and baseline.json all say v0.732.0.
• Baseline was written by the tool: failing: [], totals 7450 / 7273 / 0 / 0 / 177.
• Matrix 38287888235 (at 894d9ed): success. RustCFML v0.732.0 sha-verified (f3d893bf…): 7273 pass, 0 fail, 0 error, 177 skipped.
• The removed and re-added logs contain nothing sensitive. They're CI-runner test output only: http://127.0.0.1:8513, /home/runner/work/... paths, test job UUIDs, the documented csrfCookieEncryptionSecretKey was empty — auto-generated a temporary AES key warning (no key value), and example hosts (example.com, guides.wheels.dev). No credentials, tokens, keys or emails.

[bpamiri]

Final review: head 7ae90c4. APPROVE (ready to merge).

• Clean regeneration. Bot commit 21bf8ac (dispatch 38289638611 on develop fe7cee8, after ci: commit only the bump files in the auto-bump PRs #4578/ci(rustcfml): --write-baseline rewrites the baseline's provenance note #4579) plus the signed-off empty CI-trigger commit 7ae90c4, whose tree equals 21bf8ac's. The net diff against develop is exactly 4 files: ENGINE_VERSION, ENGINE_SHA256, baseline.json, RustCFMLEngine.cfc. No public/logs/*.log and no __pycache__.
• Pins. All three sha256s in ENGINE_SHA256 and RustCFMLEngine.cfc equal the published digests of the RustCFML v0.732.0 release assets, and the version is v0.732.0 in all four places.
• Baseline (written by the tool):
  • failing: [], totals 7450 / 7273 / 0 / 0 / 177;
  • _notes[0] is now the generated provenance line (run 38289638611, fe7cee8, v0.732.0, Linux, 7273/0/0/177), and the other three notes are kept.
• Evidence.
  • PR CI at 7ae90c4: 15 pass, 0 fail, 2 skipped. RustCFML (Linux) downloaded the sha-verified binary (f3d893bf…, which reports v0.732.0): 7273 pass, 0 fail, 0 error, 177 skipped.
  • Matrix 38287888235 (same pin) gave the same result.
  • Merge state is CLEAN.
• Logs from the earlier bot push. They remain in this PR's old (replaced) commits only, not on this head, and contain nothing sensitive (as noted above).