fix(ci): re-pin standards reusables to lockfile-bearing ref (#342)

Caller-side lockfile enforcement demands `actions.lock` in the called
repo **at the pinned ref**. standards shipped its lockfile
(#570/#571/#572); these 7 callers still pinned pre-lockfile SHAs, so
they remained `startup_failure` after #341 unbricked the inline
workflows.

Re-pins governance, hypatia-scan, mirror, rust-ci, scorecard,
secret-scanner, spark-theatre-gate to `fcb8669169b4` (standards main,
2026-08-04). Every pin verified resolvable via the commits API.

**Expected on this PR**: the callers *start* (real jobs/conclusions).
Honest reds are possible — the governance/hypatia reusables float ahead
of echidna's 07-28 baseline — and are follow-up content work, strictly
better than a gate that never runs.

**Not fixed here**: `security-scan.yml` calls
`hyperpolymath/panic-attack`, which needs its own lockfile first.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/actions.lock

@@ -43,12 +43,15 @@ workflows:
     '.github/workflows/ghcr-publish.yml':
         - 'actions/attest-build-provenance@v4.1.1'
         - 'actions/checkout@v7.0.1'
+    '.github/workflows/governance.yml': []
+    '.github/workflows/hypatia-scan.yml': []
     '.github/workflows/idris2-abi-ci.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/live-provers.yml':
         - 'actions/checkout@v7.0.1'
         - 'dtolnay/rust-toolchain@stable'
         - 'swatinem/rust-cache@v2.9.1'
+    '.github/workflows/mirror.yml': []
     '.github/workflows/mvp-smoke.yml':
         - 'actions/checkout@v7.0.1'
         - 'dtolnay/rust-toolchain@stable'
@@ -58,15 +61,20 @@ workflows:
         - 'actions/checkout@v7.0.1'
         - 'actions/deploy-pages@v5.0.0'
         - 'actions/upload-pages-artifact@v5.0.0'
+    '.github/workflows/rust-ci.yml': []
     '.github/workflows/s4-loop.yml':
         - 'actions/checkout@v7.0.1'
         - 'dtolnay/rust-toolchain@stable'
         - 'swatinem/rust-cache@v2.9.1'
         - 'taiki-e/install-action@v2.85.3'
+    '.github/workflows/scorecard.yml': []
+    '.github/workflows/secret-scanner.yml': []
+    '.github/workflows/security-scan.yml': []
     '.github/workflows/server-boot-gate.yml':
         - 'actions/checkout@v7.0.1'
         - 'dtolnay/rust-toolchain@stable'
         - 'swatinem/rust-cache@v2.9.1'
+    '.github/workflows/spark-theatre-gate.yml': []
     '.github/workflows/verification-proofs-cron.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/workflow-linter.yml':

.github/workflows/governance.yml

@@ -10,8 +10,9 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 # main 2026-07-07 (baseline-gated hypatia — standards#455/#464/#466)
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4 # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570)

.github/workflows/hypatia-scan.yml

@@ -12,10 +12,11 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
-  security-events: read
+  security-events: write
 
 jobs:
   hypatia:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@6cd3772824e59c8c9affeab66061e25383544242
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4 # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570)
     secrets: inherit

.github/workflows/mirror.yml

@@ -16,9 +16,10 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
   mirror:
-    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 # main 2026-05-30 (Radicle + Instant-Sync secret-presence gating #305)
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4 # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570)
     secrets: inherit

.github/workflows/rust-ci.yml

@@ -15,7 +15,7 @@ permissions:
 
 jobs:
   rust-ci:
-    uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@7c9db0e5909aab77bf11a444ade3b95c1d2b702e # re-pinned 2026-07-01: toolchain-required-input fix (standards#439) # main 2026-05-31 (CI/CD campaigns C001-C005)
+    uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4 # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570)
     with:
       enable_audit: true
       enable_coverage: true

.github/workflows/scorecard.yml

@@ -10,6 +10,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
@@ -21,5 +22,5 @@ jobs:
       security-events: write
       id-token: write
       contents: read
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 # main 2026-05-28 (SPDX bump #249)
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4 # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570)
     secrets: inherit

.github/workflows/secret-scanner.yml

@@ -19,5 +19,5 @@ jobs:
     # caller must grant at least that or the run startup-fails.
     permissions:
       contents: read
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586 # main 2026-05-28 (SPDX bump #249 + pragma/.shell-secrets-ignore fix #236)
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4 # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570)
     secrets: inherit

.github/workflows/spark-theatre-gate.yml

@@ -12,11 +12,12 @@ on:
     branches: [main, master]
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
   spark-theatre-gate:
-    uses: hyperpolymath/standards/.github/workflows/spark-theatre-gate.yml@e03686486e11b662834d7090dffae54c3e96fd59 # main 2026-05-28 (SPDX bump #249)
+    uses: hyperpolymath/standards/.github/workflows/spark-theatre-gate.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4 # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570)
     with:
       paths: "."
       enforce_zero_contract: false