chore(ci): bump standards reusable pins past #219 governance fix (#353)

## Root-cause summary

`governance / Language / package anti-pattern policy` has been failing
on hypatia/main (and on every open PR) because:

- `.github/workflows/governance.yml:34` pinned
`governance-reusable.yml@66271d3` (2026-05-22) — predates
[hyperpolymath/standards#219](hyperpolymath/standards#219)
(merged `ad366b6`, 2026-05-27).
- standards#219 fixes a `workflow_sha` resolution bug: in a reusable
workflow, `github.workflow_sha` resolves to the **caller's** SHA, not
the reusable's SHA. The inner self-checkout of `hyperpolymath/standards`
therefore asked the standards repo for a SHA that only exists in hypatia
→ `exit 128` after 3 retries.

This PR bumps both standards-reusable pins past that fix.

## Pins changed

| File | Before | After |
|---|---|---|
| `.github/workflows/governance.yml:34` | `66271d3...` (2026-05-22) |
`5eb28d7d8790d5389b7b6a5233fe6265a775e3d0` (standards/main, 2026-05-27)
|
| `.github/workflows/hypatia-scan.yml:28` | `97df762...` (orphan SHA on
PR-branch for #193) | `5eb28d7d8790d5389b7b6a5233fe6265a775e3d0`
(canonical main) |

## Delta picked up (governance side)

7 commits, all fixes / hardening:

- `ad366b6` `fix(governance-reusable): pin standards self-checkout to
main` (#219) **— the load-bearing fix**
- `481c496` `feat(governance): add check-trusted-base CI enforcement`
(#211)
- `0ec0b83` `fix(governance): eradicate inline Python from
governance-reusable.yml` (#189)
- `3285ac1` `fix(baseline): file_pattern glob matching + jq scoping
bugs` (#180)
- `431adbb` `refactor(governance): subsume language-policy.yml + add
deno-ci-reusable` (#168)
- `91d8b88` `feat: consume .hypatia-baseline.json in governance gate`
(#166)
- `43b6563` `fix: checkout caller's repo in governance-reusable
workflow`

Delta on hypatia-scan side: **none** (reusable file unchanged since #193
squash-merge).

## Estate implication

This same stale-pin pattern affects every repo whose `governance.yml`
wrapper points to a pre-`ad366b6` SHA of `governance-reusable.yml`. An
estate-wide fan-out bump-PR sweep is the comprehensive remedy (cf.
session memory on the doomed-CI pilot). This PR is the per-repo first
cut for hypatia.

## Auto-merge

SQUASH (per estate policy).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/governance.yml

@@ -31,4 +31,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@66271d324b03861a8a9a33712c28894e39196da5
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@5eb28d7d8790d5389b7b6a5233fe6265a775e3d0

.github/workflows/hypatia-scan.yml

@@ -25,5 +25,5 @@ permissions:
 
 jobs:
   hypatia:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@97df762107501909f50bb770e9bc200b6c415600
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@5eb28d7d8790d5389b7b6a5233fe6265a775e3d0
     secrets: inherit