fix(sync): anchor the pin script's pattern at the owner boundary

[zgeoff]

Fixes GEO-1024

Description

The pin script matched zgeoff/tools/... as a suffix, so a call to other-zgeoff/tools/... also got the sync tag. The pattern now needs the line start or a character outside an owner name before zgeoff.

• The boundary class [^A-Za-z0-9._/-] keeps the quote, brace, and space cases that the existing tests cover.

Testing

• bun test scripts/pin-tools-ref.test.ts: 8 pass, 0 fail
• Acceptance 1: the new test it leaves a call to an owner whose name ends in zgeoff alone keeps other-zgeoff/tools/.github/workflows/ci.yml@main and prints nothing. Against the old script it fails (7 pass, 1 fail).
• Acceptance 2: the existing tests still pin zgeoff/tools/.github/workflows/*.yml@main to the ref, bare, quoted, and flow-style.
• bun run lint passes (pre-commit hook)
• bun run typecheck: CI

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: zgeoff/coderabbit/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Essentials
• Run ID: 6dc57929-8088-49be-895a-695bd7371c69

📥 Commits

Reviewing files that changed from the base of the PR and between f31fc6d and af62071.

📒 Files selected for processing: 2

• scripts/pin-tools-ref.sh
• scripts/pin-tools-ref.test.ts

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

📝 Walkthrough

The workflow-reference pattern now checks the character before the owner name and preserves that boundary when it replaces a ref. A regression test verifies that a similar owner name is not changed.

Changes: Workflow reference matching

Layer / File(s)	Summary
Boundary pattern and regression test scripts/pin-tools-ref.sh, scripts/pin-tools-ref.test.ts	The script requires a start-of-line or non-owner character before the workflow path and preserves that character during replacement. The test checks that a reference owned by other-zgeoff is unchanged and is not reported as changed.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to af620

This change is limited to workflow-reference boundary matching, with a regression test for the reported owner-name collision. No merge-blocking issue is established.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: anchoring the pin script pattern at the owner boundary.
Description check		The description directly explains the bug, the boundary fix, the added regression test, and the reported validation results.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}