Brief a coding agent to fix a failing CI build

Goal: Make the failing CI pipeline on {{branch}} pass again by fixing the cause of the failure, so that the team can merge with checks they trust.

Context:
- CI system and the job that fails: {{ci_job}} (for example .github/workflows/ci.yml, job "test")
- The failing step's log:
"""
{{ci_log}}
"""
- When it started failing, and what changed around then, as far as I know: {{recent_changes}}
- Commands that run the same checks locally: {{local_commands}}

Constraints:
- Reproduce first. Run the failing step locally with the versions CI uses: read the workflow file for the runtime, package manager, tool versions and environment variables. If it passes locally, compare the two environments and report the difference before changing anything.
- Find the cause and explain it in 2 to 3 sentences before editing. Common causes include a dependency that published a new version, a lockfile out of date with the manifest, a tool version that differs between CI and local, a test that depends on time or order, and a missing environment variable or secret.
- Fix the cause in the code, the lockfile or a pinned version. Do not disable, skip or delete the failing check, lower a coverage or lint threshold, add retries, or mark a job as allowed to fail.
- Change the CI configuration only if the cause is in it, and explain the change. Never print, echo or change secrets.
- Do not touch {{off_limits}}.

Done when:
- The step that failed passes locally with the CI versions.
- The full local check passes: {{local_commands}}

Verify: run the commands, read the output and iterate until they pass. Then report in this format: Cause, Fix, Files changed, Commands run with the last 20 lines of their output, and anything I must do in CI myself, such as adding a secret or clearing a cache. If the failure comes from an outside service, such as a package registry outage, or needs access you do not have, stop and tell me instead of working around it.