Upstream: stabilize `standards` history — force-pushes orphan consumers' pinned SHAs

[hyperpolymath]

Problem

Consumer repos pin the hyperpolymath/standards reusables by SHA. Those pins keep getting orphaned within hours, repeatedly breaking the Check Workflow Staleness gate across the estate.

Evidence (this repo):

• ci(governance): bump standards reusables to d72fe5a; retire interim hypatia pin #26 pinned the 3 reusables to d72fe5a14e84 — staleness was green on PR chore: clear genuine Hypatia findings (stale src/abi docs, setup.sh, .envrc) #27.
• Hours later, staleness failed on docs: close-out — honest quickstart, sketch guides/ADRs, wiki seed, planned scaffolding #29:

  d72fe5a14e84 is not a recognised ancestor of standards HEAD (09e7023d2468). It may be forged, from a fork, or too divergent to verify. Pin a published standards commit.

• A previously-valid published commit becoming a non-ancestor of HEAD means standards/main was rebased / force-pushed, not merely advanced.

A band-aid re-pin to 09e7023d is in PR claude/bump-standards-09e7023d, but it will re-orphan on the next force-push.

Impact

Every consumer of the standards reusables goes red on Check Workflow Staleness until it re-pins — and then again after the next force-push. Combined with the un-guarded Hypatia scan (#28), the shared estate is chronically red through no fault of the consuming repos.

Recommended upstream fixes (in hyperpolymath/standards)

1. Stop force-pushing main — use fast-forward / merge commits so published SHAs remain ancestors of HEAD.
2. Cut tagged releases (e.g. v1 moving tag, or dated release tags) and let consumers + the staleness script accept tags, so pins are stable references rather than mutable SHAs.
3. (Optional) Publish a "known-good pins" manifest that the staleness script and Renovate can target.

Related / blocked

• Upstream fixes to green Hypatia: restore advisory scan-guard (standards) + 3 scanner false-positive rules (hypatia) #28 — Hypatia advisory scan-guard regression + 3 false-positive rules (also upstream, in standards / hypatia).
• The actual upstream PRs cannot be made from a gv-clade-index-scoped session — they need a session scoped to hyperpolymath/standards (and hyperpolymath/hypatia). Patches are ready in Upstream fixes to green Hypatia: restore advisory scan-guard (standards) + 3 scanner false-positive rules (hypatia) #28; the fixes here are one-liners (no force-push policy + tags).