docs(bots): reconcile design-doc engine SHA + flag the 4-way pin lockstep

Review follow-up (F2): the workflows pin engine d24ca21 but the design doc still
said b6205fb, so a reviewer couldn't confirm which engine is installed.

- Update the design doc's operative "Pinned to" line to d24ca21 (post-#107,
  issue-Type flow selection), noting the earlier b6205fb draft.
- Add a comment at each of the four engine-ref pin sites noting the SHA is
  duplicated across all four bot workflows and must be bumped in lockstep.

Co-authored-by: Isaac
Signed-off-by: eric-wang-1990 <e.wang@databricks.com>

Author: eric-wang-1990

.github/workflows/engineer-bot-followup.yml

@@ -101,6 +101,9 @@ jobs:
         with:
           app-id: ${{ secrets.ENGINEER_BOT_APP_ID }}
           private-key: ${{ secrets.ENGINEER_BOT_APP_PRIVATE_KEY }}
+          # Pinned engine SHA. DUPLICATED in all four bot workflows
+          # (engineer-bot{,-followup}.yml, reviewer-bot{,-followup}.yml) — bump
+          # them in LOCKSTEP or the bots silently run different engine versions.
           engine-ref: d24ca2171d191a652a67f4f43995f0959c9a5791
 
       # Run the follow-up. Inlines the engine's bot-run env contract for

.github/workflows/engineer-bot.yml

@@ -89,6 +89,9 @@ jobs:
         with:
           app-id: ${{ secrets.ENGINEER_BOT_APP_ID }}
           private-key: ${{ secrets.ENGINEER_BOT_APP_PRIVATE_KEY }}
+          # Pinned engine SHA. DUPLICATED in all four bot workflows
+          # (engineer-bot{,-followup}.yml, reviewer-bot{,-followup}.yml) — bump
+          # them in LOCKSTEP or the bots silently run different engine versions.
           engine-ref: d24ca2171d191a652a67f4f43995f0959c9a5791
 
       - name: Resolve issue + gather context

.github/workflows/reviewer-bot-followup.yml

@@ -77,6 +77,9 @@ jobs:
         with:
           app-id: ${{ secrets.REVIEW_BOT_APP_ID }}
           private-key: ${{ secrets.REVIEW_BOT_APP_PRIVATE_KEY }}
+          # Pinned engine SHA. DUPLICATED in all four bot workflows
+          # (engineer-bot{,-followup}.yml, reviewer-bot{,-followup}.yml) — bump
+          # them in LOCKSTEP or the bots silently run different engine versions.
           engine-ref: d24ca2171d191a652a67f4f43995f0959c9a5791
 
       - name: Run reviewer follow-up

.github/workflows/reviewer-bot.yml

@@ -82,6 +82,9 @@ jobs:
         with:
           app-id: ${{ secrets.REVIEW_BOT_APP_ID }}
           private-key: ${{ secrets.REVIEW_BOT_APP_PRIVATE_KEY }}
+          # Pinned engine SHA. DUPLICATED in all four bot workflows
+          # (engineer-bot{,-followup}.yml, reviewer-bot{,-followup}.yml) — bump
+          # them in LOCKSTEP or the bots silently run different engine versions.
           engine-ref: d24ca2171d191a652a67f4f43995f0959c9a5791
 
       - name: Resolve trigger inputs

docs/superpowers/specs/2026-07-14-onboard-bot-engine-design.md

@@ -194,10 +194,13 @@ databricks-bot-engine, adopting **both** bots and used to surface onboarding
 friction back to the engine.
 
 ### Reviewer — flipped to PAT-free App-auth
-Pinned to engine SHA `b6205fb502566d617a456ccf3c37f3e4e3072ccd` (post-#100). Both
-reviewer workflows now pass `engine-auth: app` and **drop `engine-pat`**: the
-reusable mints a short-lived, engine-scoped GitHub App installation token from
-the review-bot App creds it already receives. No `BOT_ENGINE_PAT` secret.
+Pinned to engine SHA `d24ca2171d191a652a67f4f43995f0959c9a5791` (post-#107, which
+selects the engineer author flow from the issue **Type** — Bug ⇒ bug-fix, Feature
+⇒ enhancement; earlier drafts pinned `b6205fb`, post-#100). Both reviewer
+workflows pass `engine-auth: app` and **drop `engine-pat`**: the reusable mints a
+short-lived, engine-scoped GitHub App installation token from the review-bot App
+creds it already receives. No `BOT_ENGINE_PAT` secret. The same SHA is pinned in
+all four bot workflows (bump them in lockstep).
 
 ### Engineer-bot — added (bug-fix flow)
 - `engineer-bot.yml` (author) + `engineer-bot-followup.yml` — own jobs (not