ci(governance): re-pin to post-#464 standards (baseline filter now actually runs) (#172)

## Summary

Follow-up to #171. That PR pinned standards `832b157` (which had #455's
baseline-filter wire-in), but #455 had a bug — the scan's by-design
exit-on-findings aborted the step under `bash -e` *before* the filter
ran, so the gate was still mechanically broken. **standards#464** fixed
that (`|| true` + a JSON-array crash guard). This re-pins
`governance-reusable` **`832b157` → `f81bb04`** (current standards
`main`, both #455 and #464 present).

Still surgical: the other five standards reusables stay at `7c9db0e`.

## What this PR is for (diagnostic)

This is the run where `validate-hypatia-baseline` finally *reaches*
`apply-baseline.sh`. The newer hypatia HEAD now reports **18 findings vs
the 14** neurophone's `.hypatia-baseline.json` was written against
(#168), so the outcome will be one of:

- **Green** — if the current baseline happens to cover all 18. Done.
- **Red on the delta** — the filter kept some genuinely-new findings
(there's a **new critical**, 2→3). That is the filter working correctly.
Those get **honest per-repo handling** — fix-at-source, or baseline
*only* verified false-positives — **never blind-baselined**, and the
critical goes to the owner for a decision first.

I'll read this PR's filter output and report exactly which findings are
kept.

Draft pending that diagnosis.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_0172RBMz3qYjb1ttzD2i7RNh

---
_Generated by [Claude
Code](https://claude.ai/code/session_0172RBMz3qYjb1ttzD2i7RNh)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/governance.yml

@@ -31,4 +31,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@832b1578ecaeeb27dad54f133630ebd670f6e752 # bumped 2026-07-03: standards#455 wires apply-baseline.sh into validate-hypatia-baseline (the check now actually consults .hypatia-baseline.json). Other standards reusables intentionally left at 7c9db0e.
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@f81bb0453ab7fda0cea94127d3855f83968fb9e8 # bumped 2026-07-03: standards#455 wired apply-baseline.sh into validate-hypatia-baseline AND #464 fixed it actually running (the #455 wire-in aborted under `bash -e` on the scan's exit-on-findings before the filter ran). Other standards reusables intentionally left at 7c9db0e.