fix(ci): close the governance gate — SPDX, permissions, SHA pins, reusable bump

fix(ci): close the governance gate — SPDX, permissions, SHA pins, reusable bump #41