docs: correct workflow publishing security-review claim, add catalog vetting notes

[chelsealong]

Fixes #4733.

Problem

workflows/PUBLISHING.md described the workflow submission "Verification Process" as including a Security check ("no malicious shell commands, safe operations") and stated that "catalog-listed workflows are reviewed at submission time," then said the workflow "appears in specify workflow search" once "verified." In reality maintainers only check submission form and completeness (schema validity, step correctness, input design, documentation) — they do not review, audit, or endorse the shell step content a workflow actually runs. This directly contradicts the file's own later "Security: shell steps execute arbitrary code" section, which correctly tells users to audit run fields themselves.

Separately, docs/reference/presets.md and docs/reference/bundles.md document how to mark a catalog install_allowed but, unlike docs/reference/extensions.md (added in #4177), never warn that a project-supplied catalog or an install_allowed flag is not evidence the catalog's contents were vetted.

docs/community/extensions.md, docs/community/presets.md, and docs/community/bundles.md already use the correct "entry form and completeness only, not component code" language, so no changes were needed there.

Changes

• workflows/PUBLISHING.md: rewrote the "Verification Process" section to drop the Security review claim and state plainly that the check covers submission form/completeness, not the shell code the workflow runs; updated the follow-on sentence that referenced "workflows are reviewed at submission time" to match. A follow-up commit then reconciled this new wording with the pre-existing "Authors" bullet under "Security: shell steps execute arbitrary code," which said maintainers "will reject submissions whose shell steps can't be justified at review time" — as first worded, the two statements flatly contradicted each other (one said maintainers never look at shell content, the other said they reject based on it). All three references now consistently say maintainers may reject a submission whose shell steps look obviously dangerous during the form/completeness pass, but this is never a security audit and shouldn't be relied on as one.
• docs/reference/presets.md: added a note in "Catalog Management" that a project's .specify/preset-catalogs.yml can point at an unvetted catalog, and that install_allowed should only be set on a catalog you authored or vetted yourself (mirrors the existing guidance in docs/reference/extensions.md).
• docs/reference/bundles.md: added an equivalent note in "Manage Catalog Sources" covering both the bundle catalog source itself and the component catalogs (extension/preset/workflow) a bundle can pull in.
• Added tests/test_catalog_trust_docs.py with regression assertions for the three changes above.

Test plan

$ python3 -m pytest tests/test_catalog_trust_docs.py -v
tests/test_catalog_trust_docs.py::test_workflow_publishing_does_not_claim_security_review PASSED
tests/test_catalog_trust_docs.py::test_preset_catalog_docs_warn_about_vetting_install_allowed PASSED
tests/test_catalog_trust_docs.py::test_bundle_catalog_docs_cover_bundle_source_and_component_catalogs PASSED
3 passed in 0.04s

Confirmed the new test fails without the fix by checking out the pre-change versions of the three docs files (git checkout HEAD~2 -- workflows/PUBLISHING.md docs/reference/presets.md docs/reference/bundles.md) and re-running — all three assertions failed as expected, then passed again once the docs were restored.

npx markdownlint-cli2 on the edited doc: 0 issues in 0 files.

AI disclosure

Implemented autonomously by Claude Code (model: Claude Sonnet 5), running non-interactively end-to-end: issue re-verification, doc edits, regression test, and lint validation were all AI-generated and AI-executed with no human line-by-line review prior to this push. A follow-up commit (also autonomous, same model) reconciled a contradiction an independent review caught in the first commit's PUBLISHING.md wording.

🤖 Generated with Claude Code

[Copilot]

Copilot review overview

🟡 Changes recommended

Workflow user guidance remains incomplete, and bundle guidance omits step catalogs.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 3

Open (3)

• Include step catalogs and inspection command in trust warning · New
• Assert step-catalog inspection command in regression test · New
• Add catalog trust guidance to workflow reference instructions · New

What changed in this PR

Clarifies catalog trust boundaries and workflow review scope.

Changes:

• Corrects workflow publishing security-review claims.
• Adds preset and bundle catalog vetting guidance.
• Adds documentation regression tests.

File	Description
workflows/​PUBLISHING.md	Clarifies submission checks and security responsibility.
docs/​reference/​presets.md	Adds install-enabled catalog vetting guidance.
docs/​reference/​bundles.md	Adds bundle and component-source vetting guidance.
tests/​test_catalog_trust_docs.py	Tests the new documentation requirements.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[chelsealong]

Addressed all three review comments in 9369001:

• docs/reference/bundles.md: the catalog-trust warning now includes step catalogs (fourth component source) and the specify workflow step catalog list inspection command.
• docs/reference/workflows.md: added an equivalent catalog-vetting warning in "Catalog Management" (next to workflow run/add/.specify/workflow-catalogs.yml), since the earlier fix only touched the author-facing publishing guide.
• tests/test_catalog_trust_docs.py: added assertions that explicitly check for the specify workflow step catalog list command in both files, so an incomplete list regresses loudly.

Confirmed both new assertions fail against the pre-fix docs (git checkout HEAD~1 -- docs/reference/bundles.md docs/reference/workflows.md) and pass again after restoring. Full suite: 2563 passed, 5 skipped.

[Copilot]

Copilot review overview

🟢 Approval recommended

The documentation is consistent with the stated trust model, references valid commands, and includes focused regression coverage.

Review effort: Balanced
Findings: 1

Open (1)

• Add catalog trust guidance to workflow reference instructions

Resolved since last review (2)

• Assert step-catalog inspection command in regression test
• Include step catalogs and inspection command in trust warning