ci: fix CI/CD configuration (campaigns C001-C005)

- C001: CodeQL language fixes
- C002: License identifier standardization
- C003: Outdated actions audit
- C004: Pin standards refs to SHA 861b5e9
- C005: Add workflow-level permissions

Author: hyperpolymath

.github/workflows/changelog-reusable.yml

@@ -10,7 +10,7 @@
 # Caller example (auto-update CHANGELOG.md on every push to main):
 #   jobs:
 #     changelog:
-#       uses: hyperpolymath/standards/.github/workflows/changelog-reusable.yml@main
+#       uses: hyperpolymath/standards/.github/workflows/changelog-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613
 #       permissions:
 #         contents: write
 #         pull-requests: write

.github/workflows/deno-ci-reusable.yml

@@ -23,7 +23,7 @@
 #
 #   jobs:
 #     deno-ci:
-#       uses: hyperpolymath/standards/.github/workflows/deno-ci-reusable.yml@main
+#       uses: hyperpolymath/standards/.github/workflows/deno-ci-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613
 
 name: Deno CI (reusable)
 

.github/workflows/elixir-ci-reusable.yml

@@ -33,13 +33,13 @@
 #
 #   jobs:
 #     elixir-ci:
-#       uses: hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@main
+#       uses: hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613
 #
 # With dialyzer + customised versions:
 #
 #   jobs:
 #     elixir-ci:
-#       uses: hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@main
+#       uses: hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613
 #       with:
 #         elixir-version: "1.18"
 #         enable_dialyzer: true
@@ -49,7 +49,7 @@
 #
 #   jobs:
 #     elixir-ci:
-#       uses: hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@main
+#       uses: hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613
 #       with:
 #         working_directory: server
 

.github/workflows/governance-reusable.yml

@@ -20,7 +20,7 @@
 # Caller example (single wrapper):
 #   jobs:
 #     governance:
-#       uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@main
+#       uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613
 #
 # Hypatia baseline integration (added 2026-05-25):
 #   - A caller repo may carry `.hypatia-baseline.json` (array of

.github/workflows/governance.yml

@@ -31,4 +31,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@main
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613

.github/workflows/rust-ci-reusable.yml

@@ -19,13 +19,13 @@
 #
 #   jobs:
 #     rust-ci:
-#       uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@main
+#       uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613
 #
 # With audit + coverage enabled:
 #
 #   jobs:
 #     rust-ci:
-#       uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@main
+#       uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613
 #       with:
 #         enable_audit: true
 #         enable_coverage: true
@@ -34,11 +34,11 @@
 #
 #   jobs:
 #     rust-ci-cli:
-#       uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@main
+#       uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613
 #       with:
 #         working_directory: crates/cli
 #     rust-ci-server:
-#       uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@main
+#       uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613
 #       with:
 #         working_directory: crates/server
 #