ci: pin remaining actions to commit SHAs, add coverage regression gate, review runner token scope

[OgeonX-Ai]

Summary

Closes out ci-autopilot's remaining supply-chain gaps (S1) and the P3 coverage-gate backlog item, per Phase 31 wave 2 plan 31-05 (REQ-1.4.10).

• SHA-pin the 4 remaining unpinned workflow files (codeql.yml, pages.yml, pr-lint.yml, stale.yml). All third-party uses: refs now pinned to a 40-char commit SHA with a trailing # vX.Y.Z comment, resolved via gh api repos/<owner>/<action>/commits/<tag> against the tag currently in each file (checkout@v7, codeql-action/{init,autobuild,analyze}@v4, setup-python@v6, upload-pages-artifact@v5, deploy-pages@v5, action-semantic-pull-request@v6, stale@v10). ci.yml, fixer.yml, runner-health.yml, autopilot-create-issue.yml, autopilot-failure-intake.yml, runner-smoke-test.yml were already fully pinned and untouched by this change.
• Coverage regression gate (P3): ci.yml's Unit tests step now runs pytest --cov=agent --cov-report=term-missing --cov-fail-under=90 tests/ instead of python -m unittest discover -v. Added a pip install -r requirements.txt step (none existed before — requirements.txt was previously just a header comment). pytest-cov added to requirements.txt. Verified locally: 48 tests pass, 98.20% statement coverage — 90% floor is a deliberate safety margin below that baseline.
• Self-hosted-runner token scope review: Read agent/poll_once.py (the script fixer.yml runs on the self-hosted Windows runner) end-to-end. It only issues a single GET /repos/{owner}/{repo}/issues call — no gh issue create/comment or any write-scoped API call. fixer.yml's issues: read is therefore already correctly minimal; no escalation needed. runner-health.yml's issues: write is used for its stated purpose (creating/commenting on a runner-offline issue) and is already correctly scoped. No permission changes made to either file.
• NO-AZURE deploy lock check: ci-autopilot has no Azure-deploy workflow (pages.yml deploys to GitHub Pages only) — the operator lock requiring workflow_dispatch-gating on Azure-deploy workflows does not apply to this repo.

Test plan

• grep -c "uses: [a-z/-]*@v[0-9]" returns 0 for all 4 remediated files (no unpinned tag-only refs remain)
• pytest --cov=agent --cov-fail-under=90 tests/ exits 0 locally (48 passed, 98.20% coverage)
• scripts/workflow-lint.ps1 -Path portfolio/ci-autopilot -Json reports clean against this branch
• Not merged — PR opened for review only

🤖 Generated with GSD plan executor (Phase 31-05)

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.