Upgrade cpflow to 6.0.1 and drop vendored actions

.controlplane/docs/testing-cpflow-github-actions.md

@@ -33,28 +33,23 @@ helper separately when validating workflow changes.
 
 ## Released Review-App Pair
 
-The deploy/delete callers and local CLI use cpflow **6.0.0**. Both callers pin
-`68b5d83152c02a70eb98ffdc7fd2072e28265fef` with a readable `v6.0.0`
+The deploy/delete callers and local CLI use cpflow **6.0.1**. Both callers pin
+`6aa575780f2d9175755881b79cbb3253adbc9c1f` with a readable `v6.0.1`
 comment. Other generated callers intentionally remain on their existing
 **5.2.0** cohort; their migration is separate scope.
 
 The pair is inseparable: both need the generated authenticated redispatch
 input, exact run/job names, and matching permissions. A pin-only upgrade or a
 single divergent canary is rejected. The offline validator reads the installed
-6.0.0 gem's caller templates as its source of truth, without loading cpflow code.
-
-From 6.0.0 the pair runs the composite actions checked in under
-`.github/actions/cpflow-*` instead of the copies in the upstream checkout. Keep
-those directories identical to the bundled gem's `.github/actions`; the contract
-check fails when they differ. The older cohort still loads its actions from its
-own pinned upstream source.
-
-The released 6.0.0 workflow checks this repository out at the triggering
-event's own revision before it runs these actions, and checks the pull
-request's application code out separately under `app/`. The actions therefore
-carry the caller workflow's trust, not the application code's. The repository
-variables `REVIEW_APP_PREFIX` and `CPLN_ORG_STAGING` must stay set: they take
-precedence over the prefix and org in the pull request's `controlplane.yml`. The deploy caller also maps the optional
+6.0.1 gem's caller templates as its source of truth, without loading cpflow code.
+
+Both cohorts load cpflow's composite actions from their own pinned upstream
+source, so this repository checks in no `.github/actions/cpflow-*` copies.
+cpflow 6.0.0 briefly required such copies; 6.0.1 removed that requirement.
+
+The repository variables `REVIEW_APP_PREFIX` and `CPLN_ORG_STAGING` must stay
+set: they take precedence over the prefix and org in the pull request's
+`controlplane.yml`. The deploy caller also maps the optional
 `REVIEW_APP_DOCKER_BUILD_SECRETS` secret, which this repo does not define. A
 pull request's Dockerfile can read it during the build, so only ever store
 review-grade values there.
@@ -65,8 +60,8 @@ a release-tag ref and cannot be combined with a commit SHA.
 
 Do not run the all-wrapper pin helper or blindly regenerate over the customized
 validation script for this split migration. A future upgrade must update both
-callers, the local dependency/lockfile, the checked-in local actions, validator
-release constants, and fixture tests together. Preserve the renderer assertions
+callers, the local dependency/lockfile, validator release constants, and fixture
+tests together. Preserve the renderer assertions
 and separately review any changes to other caller cohorts.
 
 ## Review App Canary

.controlplane/readme.md

@@ -6,7 +6,7 @@ _If you need a free demo account for Control Plane (no CC required), you can con
 
 ---
 
-Check [how the `cpflow` gem is used in the generated GitHub Actions flow](https://github.com/shakacode/react-webpack-rails-tutorial/blob/master/.github/actions/cpflow-build-docker-image/action.yml).
+Check [how the `cpflow` gem is used in the generated GitHub Actions flow](https://github.com/shakacode/control-plane-flow/blob/v6.0.1/.github/actions/cpflow-build-docker-image/action.yml).
 Here is a brief [video overview](https://www.youtube.com/watch?v=llaQoAV_6Iw).
 
 ---
@@ -638,11 +638,9 @@ Keep the reusable-workflow mechanics in the upstream
 [`control-plane-flow` CI automation guide](https://github.com/shakacode/control-plane-flow/blob/v5.2.0/docs/ci-automation.md).
 This repo deliberately keeps two release cohorts:
 
-- The review-app deploy/delete callers pin cpflow `v6.0.0` at
-  `68b5d83152c02a70eb98ffdc7fd2072e28265fef`. The bundled `cpflow` gem and
-  lockfile use `6.0.0`. From 6.0.0 these workflows run the composite actions
-  checked in under `.github/actions/cpflow-*`, so those files must match the
-  bundled gem.
+- The review-app deploy/delete callers pin cpflow `v6.0.1` at
+  `6aa575780f2d9175755881b79cbb3253adbc9c1f`. The bundled `cpflow` gem and
+  lockfile use `6.0.1`.
 - Staging, cleanup, help, and promotion retain `v5.2.0` at
   `1d1ec7f7af181c5c6cf07f512ce336dbdb367246`. Their migration is separate
   scope, not an automatic consequence of updating the local gem.

.controlplane/shakacode-team.md

@@ -142,10 +142,8 @@ filter in `.github/workflows/cpflow-deploy-staging.yml`.
 Keep upstream workflow and action references on reviewed, immutable full commit
 SHAs with readable release comments, not release tags, `main`, or feature
 branches. The review-app deploy/delete pair advances together on released
-**6.0.0**; other generated callers and promotion actions retain their reviewed
-**5.2.0** cohort until a separately scoped migration. From 6.0.0 the pair runs
-the composite actions checked in under `.github/actions/cpflow-*`; keep them
-identical to the bundled gem.
+**6.0.1**; other generated callers and promotion actions retain their reviewed
+**5.2.0** cohort until a separately scoped migration.
 
 Do not blanket-regenerate the automation or use the all-wrapper pin helper for
 this split migration. Preserve the customized validator and renderer assertions,