fix(governance): add SPDX header to pages.yml, refresh three stale standards pins (#56)

Both failing Governance jobs are root-caused and fixed. Follows #53,
#54, #55.

## `Workflow security linter`

```
ERROR: .github/workflows/pages.yml missing SPDX header
```

`pages.yml` arrived in #51 and begins directly at `name:`. Every other
workflow already carries the header; this was the only one.

> **Recording a correction against myself.** Earlier in this programme I
audited all workflows, reported that every one had both an SPDX header
*and* a top-level `permissions:` block, and marked the SPDX hypothesis
**disproved**. That audit was wrong — it must have run against a tree
without `pages.yml`. The real cause is exactly the one first suspected.
A "disproved" hypothesis is only as good as the test that disproved it.

## `Check Workflow Staleness`

```
governance-reusable.yml pin d7c22711e830 is 63 commit(s) / 24d behind standards HEAD
  — outside the recency window (>50 commits AND >14d). Refresh toward f9dca6ded2ca
```

Three callers were pinned at `d7c22711e830`:

| Workflow | From | To |
|---|---|---|
| `governance-reusable.yml` | `d7c22711e830…` |
`f9dca6ded2cad8ab54044c1cb0489b558ae2682b` |
| `hypatia-scan-reusable.yml` | `d7c22711e830…` |
`f9dca6ded2cad8ab54044c1cb0489b558ae2682b` |
| `scorecard-reusable.yml` | `d7c22711e830…` |
`f9dca6ded2cad8ab54044c1cb0489b558ae2682b` |

Full 40-char SHAs — the gate's message quotes the abbreviated form,
which would weaken the pin.

### Deliberately not touched

- **`mirror-reusable.yml`** (`d135b05`) and
**`secret-scanner-reusable.yml`** (`c65436e`) — neither was flagged by
the staleness gate, and the secret-scanner pin in particular **should
not be moved independently of the gitleaks allowlist work**, since
re-pinning consumers ahead of the config work reintroduces false
positives.
- **`scorecard-enforcer.yml`** — the gate asks for its removal, but
**this repo doesn't have that file**. That clause is generic advice in
the reusable's message, not a finding against krl.

## Note on bumping toward standards HEAD

The newer `governance-reusable` has *more* real checks than the pinned
one (its previously-dead docs and Guix/Nix jobs were made real,
warn-first until 2026-08-21). So this bump may surface new warnings.
That is the gate working, and warn-first means it should not turn the
build red.

## Verified

`actionlint` **0 errors** · all **18** workflows carry an SPDX header

Author: hyperpolymath

.github/workflows/governance.yml

@@ -13,4 +13,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@f9dca6ded2cad8ab54044c1cb0489b558ae2682b

.github/workflows/hypatia-scan.yml

@@ -16,4 +16,4 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@f9dca6ded2cad8ab54044c1cb0489b558ae2682b

.github/workflows/pages.yml

@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 name: GitHub Pages (Ddraig SSG)
 on:
   push:

.github/workflows/scorecard.yml

@@ -13,7 +13,7 @@ permissions:
 
 jobs:
   scorecard:
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@f9dca6ded2cad8ab54044c1cb0489b558ae2682b
     permissions:
       contents: read
       security-events: write