chore: pin runtime to 0.1.131 (publish-runtime cascade)

Co-Authored-By: publish-runtime cascade <publish-runtime@moleculesai.app>

.github/workflows/publish-image.yml

@@ -25,7 +25,33 @@ permissions:
   packages: write
 
 jobs:
+  # The `.runtime-version` file is the push-mode cascade signal post-
+  # 2026-05-06: when molecule-core/publish-runtime.yml ships a new
+  # version to PyPI, it does NOT call repository_dispatch (Gitea 1.22.6
+  # has no such endpoint — empirically verified molecule-core#20).
+  # Instead it git-pushes an updated `.runtime-version` to each template,
+  # which trips this workflow's `on: push: branches: [main]` trigger.
+  # This job reads that file and forwards the version to the reusable
+  # build workflow.
+  resolve-version:
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    outputs:
+      version: ${{ steps.read.outputs.version }}
+    steps:
+      - uses: actions/checkout@v4
+      - id: read
+        run: |
+          if [ -f .runtime-version ]; then
+            v="$(head -n1 .runtime-version | tr -d '[:space:]')"
+            echo "version=$v" >> "$GITHUB_OUTPUT"
+            echo "resolved runtime version: $v"
+          else
+            echo "no .runtime-version file present — falling through to Dockerfile default"
+          fi
+
   publish:
+    needs: resolve-version
     uses: Molecule-AI/molecule-ci/.github/workflows/publish-template-image.yml@main
     secrets: inherit
     with:
@@ -33,4 +59,4 @@ jobs:
       # version PyPI just published. Forwarded as a docker --build-arg
       # so the cache key changes per-version and pip install resolves
       # freshly. Empty on push/PR — falls back to requirements.txt pin.
-      runtime_version: ${{ github.event.client_payload.runtime_version || inputs.runtime_version || '' }}
+      runtime_version: ${{ github.event.client_payload.runtime_version || inputs.runtime_version || needs.resolve-version.outputs.version || '' }}

.github/workflows/secret-scan.yml

@@ -1,22 +0,0 @@
-name: Secret scan
-
-# Calls the canonical reusable workflow in molecule-core. Defense
-# against the #2090-class leak (a hosted-agent commit slipping a
-# credential-shaped string into a PR). Pattern set lives in
-# molecule-core so we do not maintain a parallel copy here.
-#
-# Pinned to @staging because that is the active default branch on the
-# upstream repo (main lags behind via the staging-promotion workflow).
-# Updates ride along automatically as the upstream regex set evolves.
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened]
-  push:
-    branches: [main, staging, master]
-  merge_group:
-    types: [checks_requested]
-
-jobs:
-  secret-scan:
-    uses: Molecule-AI/molecule-core/.github/workflows/secret-scan.yml@staging

.runtime-version

@@ -0,0 +1 @@
+0.1.131

README.md

@@ -22,6 +22,3 @@ github://Molecule-AI/template-deepagents
 
 ## License
 Business Source License 1.1 — © Molecule AI.
-
-## See also
-For the multi-agent architecture (orchestrator + task agents, file-based coordination via `/workspace/agent-shared/`), the full `config.yaml` schema, environment variables, skill loading rules, dev setup, and release process, see [`CLAUDE.md`](CLAUDE.md).