Fix workflow-audit SHA pin and accept tag pins in tend-*.yaml

The first security audit (issue #83) caught two real items:

1. workflow-audit.yaml used actions/checkout@v6 instead of a SHA
   pin. I authored that file and should have followed the same
   pattern as security-audit.yaml; SHA-pinning to v6.0.2 now,
   matching the rest of this repo.

2. tend-*.yaml also use @v6-style tag pins (actions/checkout,
   astral-sh/setup-uv). Those files are owned by the upstream
   generator, max-sixty/tend, so local SHA-pinning would diverge
   from generator output and the next nightly regen would revert.
   Reflecting reality in SECURITY.md: accept tag pins inside
   tend-*.yaml, require SHA pins everywhere else (including
   workflow-audit.yaml and security-audit.yaml).

The audit's third finding — FAIL IF #13, "workflow-audit has not
run in 48 hours" — resolves on its own once the manual trigger
completes; no code change needed.

The UNVERIFIABLE INFO findings on rulesets/secrets remain by design
until an AUDIT_PAT with `Administration: read` is provisioned.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: nedtwigg

.github/workflows/workflow-audit.yaml

@@ -23,7 +23,7 @@ jobs:
   audit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 

SECURITY.md

@@ -49,7 +49,7 @@ This repository runs the [tend](https://github.com/max-sixty/tend) agent harness
 - FAIL IF the `vscode-extension-publish` environment's deployment-branch-policies allow any ref pattern that is not admin-gated by the `Tag operations` or `Merge access` rulesets.
 - FAIL IF `CHROMATIC_PROJECT_TOKEN` is missing from `secrets.allowed` in `.config/tend.yaml`. The allowlist entry is an explicit acknowledgment that the bot can read this token.
 - FAIL IF `.github/workflows/workflow-audit.yaml` is missing, disabled, or has not produced a successful run in the last 48 hours.
-- FAIL IF any `tend-*.yaml` workflow references `max-sixty/tend` with anything other than a pinned version tag matching a published release (e.g. `@0.0.25`). The other actions inside tend's workflows must still be SHA-pinned per the rule above. The tag-pin exception for `max-sixty/tend` itself is accepted because that reference is owned by the upstream generator.
+- FAIL IF any `tend-*.yaml` workflow uses an unpinned action reference (e.g. `@main`, no version). Inside `tend-*.yaml`, both tag pins (`@v6`, `@0.0.25`) and SHA pins are accepted because the file is owned by the upstream generator (`max-sixty/tend`), which currently uses tag pins. All actions in every other workflow — including `workflow-audit.yaml` and `security-audit.yaml` — must follow the SHA-pin rule in "GitHub Actions Policies".
 - FAIL IF any agent-managed workflow (`tend-*.yaml`, `workflow-audit.yaml`, `security-audit.yaml`) grants a permission beyond `contents: write`, `pull-requests: write`, `issues: write`, `id-token: write`, `actions: read`, or any `read` permission.
 
 ## VS Code Extension Releases