fix(ci): close the governance gate — SPDX, permissions, SHA pins, reusable bump #1082

	# SPDX-License-Identifier: MPL-2.0
	name: MVP Smoke (Best Effort)

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]

	# Cause-B mitigation (#77): cancel superseded runs so stacked pushes
	# to the same ref don't pile up identical jobs in the queue.
	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	permissions:
	contents: read

	env:
	CARGO_TERM_COLOR: always

	jobs:
	mvp-smoke:
	name: MVP Smoke
	runs-on: ubuntu-latest
	timeout-minutes: 15
	permissions:
	contents: read
	steps:
	- name: Checkout repository
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4

	- name: Setup Rust toolchain
	uses: dtolnay/rust-toolchain@6d9817901c499d6b02debbb57edb38d33daa680b # stable
	with:
	toolchain: stable

	- name: Cache Cargo
	uses: Swatinem/rust-cache@65012b490220f477f20ab979e35ae732e6de4e68 # v2

	- name: Install just
	uses: taiki-e/install-action@ed67fa35ac944f3a9b33f12c4dd43b6f31a47e20 # v2.83.3
	with:
	# Governance R1 requires versioned family-tool pins
	# (just\|must\|trust\|adjust\|bust\|dust\|intend); bare `tool: just`
	# tripped the Security policy check on every push to main since
	# #130 landed (2026-05-30). 1.51.0 is the current upstream stable.
	tool: just@1.51.0

	- name: Build release
	run: cargo build --release

	- name: MVP smoke checks (best effort)
	run: just --justfile Justfile mvp-env

Provide feedback