chore(seams): bump 6 stale standards pins + fix proven manifest drift (#179)

## Summary

Seam-audit 2026-06-01 — small, safe, concrete drift fixes.

**Pin currency (Seam: echidna ↔ standards):** six reusable-workflow SHA
pins were 3-12 days stale. All bumps verified via `gh api
repos/hyperpolymath/standards/commits/<sha>` per the estate "Verify
action SHA pins" rule.

| Workflow | Was | Now | Why |
|---|---|---|---|
| secret-scanner-reusable | `3e4bd4c` (2026-05-26) | `e036864`
(2026-05-28) | SPDX #249 + pragma fix #236 |
| hypatia-scan-reusable | `915139d` (2026-05-26) | `4f07382`
(2026-05-30) | `erlef/setup-beam@v1.24.0` consolidation #289 |
| spark-theatre-gate | `4620037` (2026-05-19) | `e036864` (2026-05-28) |
SPDX #249 |
| mirror-reusable | `e6b2884` (2026-05-26) | `af5cd0c` (2026-05-30) |
Radicle + Instant-Sync secret-presence gating #305 |
| scorecard-reusable | `e0caf11` (2026-05-26) | `e036864` (2026-05-28) |
SPDX #249 |
| rust-ci-reusable | `cc5a372` (2026-05-27) | `28a8677` (2026-05-31) |
CI fix |

**Manifest drift (Seam: echidna ↔ proven):**
`.machine_readable/integrations/proven.a2ml` had two bugs:
- `version = "1.2.0"` — doesn't exist; proven/proven.ipkg in-flight is
`1.1.0`, latest released tag is `v1.0.0`. Bumped to `1.1.0` with a
tracking comment.
- `modules-available` listed `SafeJSON` and `SafeURL` (ALL-CAPS legacy)
but proven uses `SafeJson`/`SafeUrl` (Pascal-cased) in `src/*.idr`.
Case-sensitive consumers would miss them. Fixed to canonical naming.

Structural seam issues found in the same audit (GraphQL client/server
contract mismatch with echidnabot, Chapel 2.3.0 vs proven's 2.8.0,
duplicated-echidnabot meta-problem) will be filed as separate issues.

## Test plan
- [ ] CI green on this PR (the bumps themselves exercise the new
reusables)
- [ ] Confirm no `grep -r 'SafeJSON\|SafeURL'` consumers in echidna
source rely on the legacy spelling

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/hypatia-scan.yml

@@ -25,5 +25,5 @@ permissions:
 
 jobs:
   hypatia:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@915139d73560e65a8240b8fc7768698658502c89
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@4f07382468f045cdaf75e0bbdb1886a0579d83e3 # main 2026-05-30 (erlef/setup-beam v1.24.0 consolidation #289)
     secrets: inherit

.github/workflows/mirror.yml

@@ -11,5 +11,5 @@ permissions:
 
 jobs:
   mirror:
-    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@e6b2884722350515934d443daf23442f2195796f
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@af5cd0cabd8d8e3611dd594b098d4825a85fae8a # main 2026-05-30 (Radicle + Instant-Sync secret-presence gating #305)
     secrets: inherit

.github/workflows/rust-ci.yml

@@ -14,7 +14,7 @@ permissions:
 
 jobs:
   rust-ci:
-    uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@cc5a372af1af1b202c17f1b21efd954e6c038bef
+    uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@28a8677aea1759ca8f6242da35cdb6d35ad89972 # main 2026-05-31 (CI/CD campaigns C001-C005)
     with:
       enable_audit: true
       enable_coverage: true

.github/workflows/scorecard.yml

@@ -15,5 +15,5 @@ jobs:
     permissions:
       security-events: write
       id-token: write
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@e0caf11508a3989574713c78f5f444f2ce5e33ef
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@e03686486e11b662834d7090dffae54c3e96fd59 # main 2026-05-28 (SPDX bump #249)
     secrets: inherit

.github/workflows/secret-scanner.yml

@@ -15,5 +15,5 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@3e4bd4c93911750727e2e4c66dff859e00079da0
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@e03686486e11b662834d7090dffae54c3e96fd59 # main 2026-05-28 (SPDX bump #249 + pragma/.shell-secrets-ignore fix #236)
     secrets: inherit

.github/workflows/spark-theatre-gate.yml

@@ -15,7 +15,7 @@ permissions:
 
 jobs:
   spark-theatre-gate:
-    uses: hyperpolymath/standards/.github/workflows/spark-theatre-gate.yml@462003782f3ebb93ea763e81d0d199ce13ef7d73
+    uses: hyperpolymath/standards/.github/workflows/spark-theatre-gate.yml@e03686486e11b662834d7090dffae54c3e96fd59 # main 2026-05-28 (SPDX bump #249)
     with:
       paths: "."
       enforce_zero_contract: false

.machine_readable/integrations/proven.a2ml

@@ -5,12 +5,18 @@
 name = "proven"
 type = "safety-library"
 repository = "https://github.com/hyperpolymath/proven"
-version = "1.2.0"
+# Tracks proven/proven.ipkg `version =` (in-flight 1.1.0; latest released tag v1.0.0).
+# Bump when proven cuts a new release; see proven CHANGELOG for the canonical
+# release history.
+version = "1.1.0"
 
 [binding-policy]
 approach = "thin-ffi-wrapper"
 unsafe-patterns = "replace-with-proven-equivalent"
-modules-available = ["SafeMath", "SafeString", "SafeJSON", "SafeURL", "SafeRegex", "SafeSQL", "SafeFile", "SafeTemplate", "SafeCrypto"]
+# Module names match the Idris2 module identifiers under proven/src/*.idr
+# (Pascal-cased, not all-caps). Drift from these breaks any downstream
+# bindgen/lookup that consumes this manifest.
+modules-available = ["SafeMath", "SafeString", "SafeJson", "SafeUrl", "SafeRegex", "SafeSQL", "SafeFile", "SafeTemplate", "SafeCrypto"]
 
 [adoption-guidance]
 priority = "high"