ci(hypatia-scan): repin reusable to merge-commit SHA (#15) #20

Job	Run time
governance / Trusted-base reduction policy	7s
governance / Workflow security linter	10s
governance / Security policy checks	3s
governance / Validate Hypatia baseline	3s
governance / Guix primary / Nix fallback policy	3s
governance / Code quality + docs	15s
governance / Language / package anti-pattern policy	7s
governance / Well-Known (RFC 9116 + RSR)	6s
	54s

Provide feedback