fix(ci,device): drop workflow_dispatch ref input + narrow bare except in CPU info parser

[vpetersson-bot]

Takes over #2914, which was opened from a stale worktree branch in 2026-05. All three findings are still present on master, so I reimplemented them against current master (the actions/checkout pin has since advanced to v7.0.1) and added a regression test.

Two legitimate findings from a shoulder.dev security scan; the rest of that report triaged as false positives (upload path-traversal sinks are protected by uuid.*().hex + _SAFE_EXT_RE; the @authorized decorator covers the routes flagged as "missing authz"; mark_safe in asset_filters.to_json is preceded by JSON-encode + &<>' hex-escape; the open-redirect sink uses reverse() + url_has_allowed_host_and_scheme).

Changes

• .github/workflows/marketing-screenshots.yaml — drop the workflow_dispatch inputs.ref. The GH UI's "Use workflow from" picker already sets github.ref for operator-triggered runs, so the explicit input only added capability to API callers: a stolen GITHUB_TOKEN with actions:write could otherwise dispatch this workflow against an attacker-supplied SHA / fork ref and execute it on a runner. Checkout now defaults to github.ref with no ref: override.
• src/anthias_common/device_helper.py — replace except Exception: pass in parse_cpu_info with an explicit split-length guard + continue. Also fixes a latent bug: under the old fall-through, a colon-less line whose token matched a captured key (Serial/Hardware/Revision/Model) recorded the previous line's stale value.
• tests/test_device_helper.py — regression test (processor/Serial/colon-less Model); it records model='abc123' on the old code and is correctly skipped on the fix.
• .gitignore — shoulder.dev's local cache directory.

Verification

• tests/test_device_helper.py: 12 passed against the fix.
• Confirmed the new test fails on the pre-fix code (records the stale abc123) and passes after.
• ruff==0.15.21 clean; workflow YAML parses.

🤖 Generated with Claude Code

https://claude.ai/code/session_01HJ3ucEkn62cbgPoisAZ5LQ

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (master@07663c7). Learn more about missing BASE report.

Additional details and impacted files

@@            Coverage Diff            @@
##             master    #3217   +/-   ##
=========================================
  Coverage          ?   89.46%           
=========================================
  Files             ?       76           
  Lines             ?     8340           
  Branches          ?      891           
=========================================
  Hits              ?     7461           
  Misses            ?      665           
  Partials          ?      214           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[vpetersson-bot]

Validated on real hardware — full fleet

Ran the branch's parse_cpu_info (the actual code, not a transcription) against each board's real /proc/cpuinfo, comparing new vs old side-by-side. Read-only; no containers touched.

Board	Arch	cpu_count	Parsed model	new == old
Pi 5	aarch64	4	Raspberry Pi 5 Model B Rev 1.0	✅
Pi 3B+	aarch64	4	Raspberry Pi 3 Model B Plus Rev 1.3	✅
Pi 2	armv7l	4	Raspberry Pi 2 Model B Rev 1.1	✅
Pi 4	aarch64	4	Raspberry Pi 4 Model B Rev 1.1	✅
Pi 3A+	armv7l	4	Raspberry Pi 3 Model A Plus Rev 1.1	✅
Rock Pi 4	aarch64	6	(none — RK3399, no Pi Model line)	✅
x86	x86_64	2	(none — x86, lowercase model name)	✅
Pi 1 (ARMv6)	armv6l	1	Raspberry Pi Model B Rev 2	✅

Covers armv6l / armv7l / aarch64 / x86_64. On every board the new parser is byte-identical to the old, with correct values (core counts, models, serials, revisions).

Scope, stated honestly: real hardware never emits the malformed/colon-less line the fix targets, so new == old everywhere is the expected result — this proves no regression across the whole architecture matrix. The fix itself (skipping a colon-less line instead of carrying over the previous line's stale value) is proven by the added unit test test_parse_cpu_info_skips_colonless_lines, which records the stale value on the old code and is correctly skipped on the new.

Addresses the "end-to-end test for Raspberry Pi devices" and "tested for x86 devices" checklist items.