fix(governance): pin actions, add ReScript exemption ledger (#91)

## Summary

The shared `hyperpolymath/standards` governance-reusable gate has been
red on `main` since 2026-05-19 across `Language / package anti-pattern
policy` and `Workflow security linter`. Both are real policy violations,
not workflow plumbing bugs:

| Check | Cause | Fix |
|---|---|---|
| `governance / Language / package anti-pattern policy` | 33 `.res`
files (`src/rescript/`, `echidna-playground/`); estate policy bans
ReScript at the file-name level | Add `.hypatia-ignore` ledger with one
`cicd_rules/banned_language_file:<path>` line per file. CLAUDE.md notes
the AffineScript migration is in progress; ledger holds the line until
that completes. |
| `governance / Workflow security linter` | Four unpinned `uses:`
references | Pin to commit SHAs per estate action-pinning policy. |

## Changes

| File | Change |
|---|---|
| `.hypatia-ignore` (new) | 33 exemption lines + header explaining the
migration context. |
| `.github/workflows/agda-meta-checker.yml` | `haskell-actions/setup@v2`
→ `@cd0d9bdd6` (v2). `actions/cache@v4` → `@d4323d4d` (v4.2.2; matches
sibling repos). |
| `.github/workflows/security-scan.yml` |
`hyperpolymath/panic-attack/.../scan-and-report.yml@main` → `@35fb302b`.
|
| `.github/workflows/governance.yml` |
`hyperpolymath/standards/.../governance-reusable.yml@main` →
`@128a854b`. |

## Out of scope (real content issues, separate follow-up)

The 2026-05-19 main run also surfaced:
- `Validate K9 contracts` — 6 errors: missing `K9!` magic number on
`.k9.ncl` files, missing `signature` field on hunt-level files, missing
`pedigree.name`. **Real K9 contract format violations**, not
infrastructure rot.
- `Validate A2ML manifests` — 6 errors across 50 manifests. Real content
violations.
- `Code Coverage` / `Julia Integration` / `MVP Smoke` / `Minimum
Supported Rust Version` — substantive test failures.

These need their own PRs. This sweep focuses on the infrastructure-rot
category (gitignore-canonical drift, unpinned actions,
missing-permissions blocks) where the fix is mechanical and doesn't risk
degrading the quality bar.

## Test plan

- [ ] `governance / Language / package anti-pattern policy` → logs `⏭️
exempt` for each .res file, exits 0.
- [ ] `governance / Workflow security linter` → no `unpinned actions`
error, exits 0.
- [ ] Other governance sub-checks (Code quality, Security policy,
Well-Known, Guix/Nix): still pass as before.
- [ ] K9/A2ML/coverage failures remain red — out of scope, will land
separately.

Refs `hyperpolymath/standards#66` (estate-drift remediation campaign).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/agda-meta-checker.yml

@@ -33,13 +33,13 @@ jobs:
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 
       - name: Setup Haskell
-        uses: haskell-actions/setup@v2
+        uses: haskell-actions/setup@cd0d9bdd65b20557f41bea4dbe43d0b5fbbfe553 # v2
         with:
           ghc-version: '9.6'
           cabal-version: '3.10'
 
       - name: Cache Agda
-        uses: actions/cache@v4
+        uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
         with:
           path: |
             ~/.cabal

.github/workflows/governance.yml

@@ -31,4 +31,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@main
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@128a854b199848c1603c5748260ca33f0ce559c6 # main 2026-05-20

.github/workflows/security-scan.yml

@@ -20,6 +20,6 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@main
+    uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@35fb302b0bcd797ba304bcc30def77fcb18cc3db # main 2026-05-20
     secrets:
       VERISIMDB_PAT: ${{ secrets.VERISIMDB_PAT }}

.hypatia-ignore

@@ -0,0 +1,42 @@
+# Banned-language exemption ledger — hypatia / governance-reusable.yml
+#
+# Each line: <rule>:<path>
+#
+# Per CLAUDE.md: 'migrate existing src/rescript/ to AffineScript per
+# docs/ROADMAP.md'. These exemptions hold the line while the migration
+# is in progress — each entry gets removed as the matching .res file
+# is migrated to AffineScript or deleted.
+#
+cicd_rules/banned_language_file:echidna-playground/examples/SafeDOMExample.res
+cicd_rules/banned_language_file:echidna-playground/src/Components.res
+cicd_rules/banned_language_file:echidna-playground/src/Deno.res
+cicd_rules/banned_language_file:echidna-playground/src/Dom.res
+cicd_rules/banned_language_file:echidna-playground/src/JsCoq.res
+cicd_rules/banned_language_file:echidna-playground/src/Main.res
+cicd_rules/banned_language_file:echidna-playground/src/Page.res
+cicd_rules/banned_language_file:echidna-playground/src/PlaygroundServer.res
+cicd_rules/banned_language_file:echidna-playground/src/Server.res
+cicd_rules/banned_language_file:examples/SafeDOMExample.res
+cicd_rules/banned_language_file:src/provers/Mod.res
+cicd_rules/banned_language_file:src/provers/clients/LeanTool.res
+cicd_rules/banned_language_file:src/provers/clients/Metamath.res
+cicd_rules/banned_language_file:src/provers/clients/SystemOnTptp.res
+cicd_rules/banned_language_file:src/provers/clients/Unified.res
+cicd_rules/banned_language_file:src/provers/clients/UnifiedTest.res
+cicd_rules/banned_language_file:src/provers/clients/Wolfram.res
+cicd_rules/banned_language_file:src/provers/clients/Z3Wasm.res
+cicd_rules/banned_language_file:src/provers/runners/Cli.res
+cicd_rules/banned_language_file:src/provers/runners/Daemon.res
+cicd_rules/banned_language_file:src/provers/types/Prover.res
+cicd_rules/banned_language_file:src/provers/types/ProverTest.res
+cicd_rules/banned_language_file:src/provers/utils/Http.res
+cicd_rules/banned_language_file:src/rescript/src/Main.res
+cicd_rules/banned_language_file:src/rescript/src/Server.res
+cicd_rules/banned_language_file:src/rescript/src/api/Client.res
+cicd_rules/banned_language_file:src/rescript/src/components/GoalList.res
+cicd_rules/banned_language_file:src/rescript/src/components/ProofTree.res
+cicd_rules/banned_language_file:src/rescript/src/components/ProofViewer.res
+cicd_rules/banned_language_file:src/rescript/src/components/ProverSelector.res
+cicd_rules/banned_language_file:src/rescript/src/components/TacticSuggester.res
+cicd_rules/banned_language_file:src/rescript/src/components/TheoremSearch.res
+cicd_rules/banned_language_file:src/rescript/src/state/Store.res

echidna-playground/index.html

@@ -71,7 +71,7 @@ <h4>A First Example: The Infinitude of Primes</h4>
               We don't provide a Coq tutorial (yet), but as a showcase, we
               display a proof of the infinitude of primes in Coq. The proof relies
               in the Mathematical Components library by the
-              <a href="http://ssr.msr-inria.inria.fr/">MSR/Inria</a> team led
+              <a href="https://ssr.msr-inria.inria.fr/">MSR/Inria</a> team led
               by Georges Gonthier, so our first step will be to load it and
               set a few Coq options:
             </p>
@@ -169,7 +169,7 @@ <h5>Ready to do Proofs!</h5>
               <li>
                 Benoît Pin
                 (<a href="https://www.cri.ensmp.fr/">CRI</a>,
-                <a href="http://www.mines-paristech.eu">MINES ParisTech</a>)
+                <a href="https://www.mines-paristech.eu">MINES ParisTech</a>)
               </li>
             </ul>
           </div>