fix(governance): pin actions, add ReScript exemption ledger

Three coordinated fixes for the governance + workflow-security-linter
checks that have been red on `main` since 2026-05-19:

1. `.hypatia-ignore` — new file with 33 `cicd_rules/banned_language_file:<path>`
   entries, one per real `.res` file. The estate language policy bans
   ReScript at the file-name level; CLAUDE.md states the migration to
   AffineScript is in progress (`src/rescript/`). Exemption holds the
   line while migration proceeds — each entry gets removed as the
   matching file is migrated or deleted.

2. `.github/workflows/agda-meta-checker.yml` — two unpinned actions:
   - `haskell-actions/setup@v2` → `@cd0d9bdd6` (v2)
   - `actions/cache@v4` → `@d4323d4d` (v4.2.2; matches sibling repos)

3. `.github/workflows/security-scan.yml` + `governance.yml` — two
   unpinned reusable workflows:
   - `hyperpolymath/panic-attack/.../scan-and-report.yml@main` → `@35fb302b`
   - `hyperpolymath/standards/.../governance-reusable.yml@main` → `@128a854b`

These cover the `governance / Language / package anti-pattern policy`
and `governance / Workflow security linter` failures on `main`. The
remaining baseline-rot — `Validate K9 contracts` (6 errors:
missing K9! magic, missing signature, missing pedigree.name) and
`Validate A2ML manifests` (6 errors) — are real content-level
violations, not infrastructure rot, and are out of scope for this
sweep. They will be addressed under separate tracking issues.

Refs hyperpolymath/standards#66 (estate-drift remediation campaign).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/agda-meta-checker.yml

@@ -33,13 +33,13 @@ jobs:
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 
       - name: Setup Haskell
-        uses: haskell-actions/setup@v2
+        uses: haskell-actions/setup@cd0d9bdd65b20557f41bea4dbe43d0b5fbbfe553 # v2
         with:
           ghc-version: '9.6'
           cabal-version: '3.10'
 
       - name: Cache Agda
-        uses: actions/cache@v4
+        uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
         with:
           path: |
             ~/.cabal

.github/workflows/governance.yml

@@ -31,4 +31,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@main
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@128a854b199848c1603c5748260ca33f0ce559c6 # main 2026-05-20

.github/workflows/security-scan.yml

@@ -20,6 +20,6 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@main
+    uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@35fb302b0bcd797ba304bcc30def77fcb18cc3db # main 2026-05-20
     secrets:
       VERISIMDB_PAT: ${{ secrets.VERISIMDB_PAT }}

.hypatia-ignore

@@ -0,0 +1,42 @@
+# Banned-language exemption ledger — hypatia / governance-reusable.yml
+#
+# Each line: <rule>:<path>
+#
+# Per CLAUDE.md: 'migrate existing src/rescript/ to AffineScript per
+# docs/ROADMAP.md'. These exemptions hold the line while the migration
+# is in progress — each entry gets removed as the matching .res file
+# is migrated to AffineScript or deleted.
+#
+cicd_rules/banned_language_file:echidna-playground/examples/SafeDOMExample.res
+cicd_rules/banned_language_file:echidna-playground/src/Components.res
+cicd_rules/banned_language_file:echidna-playground/src/Deno.res
+cicd_rules/banned_language_file:echidna-playground/src/Dom.res
+cicd_rules/banned_language_file:echidna-playground/src/JsCoq.res
+cicd_rules/banned_language_file:echidna-playground/src/Main.res
+cicd_rules/banned_language_file:echidna-playground/src/Page.res
+cicd_rules/banned_language_file:echidna-playground/src/PlaygroundServer.res
+cicd_rules/banned_language_file:echidna-playground/src/Server.res
+cicd_rules/banned_language_file:examples/SafeDOMExample.res
+cicd_rules/banned_language_file:src/provers/Mod.res
+cicd_rules/banned_language_file:src/provers/clients/LeanTool.res
+cicd_rules/banned_language_file:src/provers/clients/Metamath.res
+cicd_rules/banned_language_file:src/provers/clients/SystemOnTptp.res
+cicd_rules/banned_language_file:src/provers/clients/Unified.res
+cicd_rules/banned_language_file:src/provers/clients/UnifiedTest.res
+cicd_rules/banned_language_file:src/provers/clients/Wolfram.res
+cicd_rules/banned_language_file:src/provers/clients/Z3Wasm.res
+cicd_rules/banned_language_file:src/provers/runners/Cli.res
+cicd_rules/banned_language_file:src/provers/runners/Daemon.res
+cicd_rules/banned_language_file:src/provers/types/Prover.res
+cicd_rules/banned_language_file:src/provers/types/ProverTest.res
+cicd_rules/banned_language_file:src/provers/utils/Http.res
+cicd_rules/banned_language_file:src/rescript/src/Main.res
+cicd_rules/banned_language_file:src/rescript/src/Server.res
+cicd_rules/banned_language_file:src/rescript/src/api/Client.res
+cicd_rules/banned_language_file:src/rescript/src/components/GoalList.res
+cicd_rules/banned_language_file:src/rescript/src/components/ProofTree.res
+cicd_rules/banned_language_file:src/rescript/src/components/ProofViewer.res
+cicd_rules/banned_language_file:src/rescript/src/components/ProverSelector.res
+cicd_rules/banned_language_file:src/rescript/src/components/TacticSuggester.res
+cicd_rules/banned_language_file:src/rescript/src/components/TheoremSearch.res
+cicd_rules/banned_language_file:src/rescript/src/state/Store.res