ci: refresh stale standards reusable-workflow pins (5a93d9d → e8fe153)

[hyperpolymath]

What

Refreshes the three standards reusable-workflow pins from the out-of-window 5a93d9d57cc0… to current standards HEAD e8fe153b568a…:

• .github/workflows/governance.yml → governance-reusable.yml@e8fe153…
• .github/workflows/hypatia-scan.yml → hypatia-scan-reusable.yml@e8fe153…
• .github/workflows/scorecard.yml → scorecard-reusable.yml@e8fe153…

Why — one stale pin caused two red checks

• governance / Check Workflow Staleness: per standards/scripts/check-workflow-staleness.sh, a pin must be a recognised ancestor of standards HEAD within the recency window (≤50 commits or ≤14 days). 5a93d9d… classified UNKNOWN → fail. e8fe153… is current HEAD → FRESH → pass.
• scan / Hypatia Neurosymbolic Analysis: the 5a93d9d… revision of hypatia-scan-reusable.yml referenced a non-existent actions/cache@d4373f26… (action-resolution error). Standards HEAD e8fe153… uses the valid actions/cache@27d5ce7… (the same SHA casket's own ci.yml/pages.yml/release.yml already pin), so the bump fixes resolution.

Verified against a local standards checkout at e8fe153…: all three reusables exist there and hypatia-scan-reusable.yml pins actions/cache@27d5ce7….

Scope notes

• No scorecard-enforcer.yml exists in this repo — the staleness summary line about it is the script's catch-all message, not a present-file finding.
• The mirror/secret-scanner reusables are not in the staleness trio and are not at the stale pin; left untouched.
• Independent of refactor(machine-readable): rename 6a2/ → descriptiles/ #35 (the 6a2/ → descriptiles/ rename); this PR is branched from main to keep that one a clean rename.
• The separate Build + Gnosis failure (a Pandoc HighlightMethod API mismatch in CasketGnosis.hs) is not addressed here — it's being folded into the Pandoc-engine decision/ADR.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WN6nPWWe4dvXfoqBG6auWN

---

Generated by Claude Code

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/hyperpolymath/standards/.github/workflows/scorecard-reusable.yml	e8fe153b568af5e3534a261eee0258fa84fa6c5e	🟢 7.3	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 30 issue activity found in the last 90 days -- score normalized to 10 Code-Review ⚠️ 0 Found 0/27 approved changesets -- score normalized to 0 Dependency-Update-Tool 🟢 10 update tool detected Security-Policy 🟢 10 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Token-Permissions 🟢 8 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 7 binaries present in source code Signed-Releases ⚠️ -1 no releases found CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 License 🟢 10 license file detected SAST 🟢 9 SAST tool detected but not run on all commits Fuzzing 🟢 10 project is fuzzed Branch-Protection 🟢 4 branch protection is not maximal on development and all release branches Vulnerabilities 🟢 4 6 existing vulnerabilities detected Contributors 🟢 6 project has 2 contributing companies or organizations -- score normalized to 6 CI-Tests 🟢 10 27 out of 27 merged PRs checked by a CI test -- score normalized to 10

Scanned Files

• .github/workflows/scorecard.yml