fix(ci): checkout the event SHA in governance jobs (re-enable PR-time enforcement) (#442)

## Summary

Fixes the estate-wide governance failure where **8 of 10 jobs in
`governance-reusable.yml` die at checkout on every PR** with:

```
fatal: couldn't find remote ref refs/pull/<n>/merge
```

(This is the `refs/pull/<n>/merge` item flagged as out-of-scope in #441
— now resolved with owner approval.)

## Root cause

`governance.yml` triggers on `pull_request` and calls
`governance-reusable.yml` via `workflow_call`. Inside a **reusable**
workflow, `github.ref` inherits the caller's PR ref, which on a
`pull_request` event is the *named merge ref* `refs/pull/<n>/merge`. The
8 jobs that pass `ref: ${{ github.ref }}` to `actions/checkout`
therefore ask it to `git fetch refs/pull/<n>/merge` — a named ref
checkout cannot resolve — and fail at the checkout step.

The two jobs that **omit** an explicit `ref:` (`workflow-staleness`,
`validate-hypatia-baseline`) use checkout's default and were unaffected
— exactly matching the observed **8/10**.

**Consequence today:** governance is effectively **ungated on PRs** —
only `push`-to-`main` runs enforce.

## Fix

Pin the 8 caller-repo checkouts to **`ref: ${{ github.sha }}`** — the
concrete event commit (the PR merge commit on `pull_request`, the pushed
commit on `push`). It resolves to the *same* commit
`refs/pull/<n>/merge` points at, but is always fetchable. A short
comment at each site explains why `github.ref` must not be used here.

- Affected jobs: `language-policy`, `package-policy`, `security-policy`,
`quality`, `wellknown`, `workflow-lint`, `trusted-base`,
`licence-consistency`.
- The 3 secondary `repository: hyperpolymath/standards` + `ref: main`
checkouts (which fetch the check scripts) are **untouched**.
- Content/enforcement semantics are preserved: the diff-based step
(`quality`'s trufflehog) already uses explicit `github.sha` /
`github.event.pull_request.base.sha`, independent of the checkout ref.

## Blast radius (owner-acknowledged)

This **re-enables PR-time governance enforcement across every repo**
consuming the reusable workflow. PRs that were silently passing (because
the jobs never ran) may now surface real governance violations. Approved
by owner 2026-06-27.

## Verification

- `python3 -c "import yaml; yaml.safe_load(...)"` → **YAML OK**.
- Structural check: 13 checkout steps total — 2 bare (unchanged), 8 now
`ref: ${{ github.sha }}`, 3 standards-checkout `ref: main` (unchanged).
No `ref: ${{ github.ref }}` remains.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---
_Generated by [Claude
Code](https://claude.ai/code/session_01MJdfXv5E5gwGD2yaJq8jRM)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/governance-reusable.yml

@@ -128,7 +128,15 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: ${{ github.repository }}
-          ref: ${{ github.ref }}
+          # Pin to the concrete event SHA (the PR merge commit on
+          # pull_request, the pushed commit on push). Do NOT use
+          # `ref: ${{ github.ref }}`: in a reusable workflow called from a
+          # pull_request, github.ref is the named merge ref
+          # `refs/pull/<n>/merge`, which actions/checkout cannot fetch
+          # ("couldn't find remote ref refs/pull/<n>/merge") — it broke 8/10
+          # governance jobs on every PR estate-wide. github.sha resolves to the
+          # same merge commit but is always fetchable.
+          ref: ${{ github.sha }}
 
       # Estate language policy bans Python with no exceptions (CLAUDE.md
       # Language Policy; SaltStack exception removed 2026-01-03). The
@@ -464,7 +472,15 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: ${{ github.repository }}
-          ref: ${{ github.ref }}
+          # Pin to the concrete event SHA (the PR merge commit on
+          # pull_request, the pushed commit on push). Do NOT use
+          # `ref: ${{ github.ref }}`: in a reusable workflow called from a
+          # pull_request, github.ref is the named merge ref
+          # `refs/pull/<n>/merge`, which actions/checkout cannot fetch
+          # ("couldn't find remote ref refs/pull/<n>/merge") — it broke 8/10
+          # governance jobs on every PR estate-wide. github.sha resolves to the
+          # same merge commit but is always fetchable.
+          ref: ${{ github.sha }}
       - name: Enforce Guix primary / Nix fallback
         run: |
           HAS_GUIX=$(find . -name "*.scm" -o -name ".guix-channel" -o -name "guix.scm" 2>/dev/null | head -1)
@@ -492,7 +508,15 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: ${{ github.repository }}
-          ref: ${{ github.ref }}
+          # Pin to the concrete event SHA (the PR merge commit on
+          # pull_request, the pushed commit on push). Do NOT use
+          # `ref: ${{ github.ref }}`: in a reusable workflow called from a
+          # pull_request, github.ref is the named merge ref
+          # `refs/pull/<n>/merge`, which actions/checkout cannot fetch
+          # ("couldn't find remote ref refs/pull/<n>/merge") — it broke 8/10
+          # governance jobs on every PR estate-wide. github.sha resolves to the
+          # same merge commit but is always fetchable.
+          ref: ${{ github.sha }}
       - name: Security checks
         run: |
           FAILED=false
@@ -723,7 +747,15 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: ${{ github.repository }}
-          ref: ${{ github.ref }}
+          # Pin to the concrete event SHA (the PR merge commit on
+          # pull_request, the pushed commit on push). Do NOT use
+          # `ref: ${{ github.ref }}`: in a reusable workflow called from a
+          # pull_request, github.ref is the named merge ref
+          # `refs/pull/<n>/merge`, which actions/checkout cannot fetch
+          # ("couldn't find remote ref refs/pull/<n>/merge") — it broke 8/10
+          # governance jobs on every PR estate-wide. github.sha resolves to the
+          # same merge commit but is always fetchable.
+          ref: ${{ github.sha }}
       - name: Check file permissions
         run: |
           find . -type f -perm /111 -name "*.sh" | head -10 || true
@@ -772,7 +804,15 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: ${{ github.repository }}
-          ref: ${{ github.ref }}
+          # Pin to the concrete event SHA (the PR merge commit on
+          # pull_request, the pushed commit on push). Do NOT use
+          # `ref: ${{ github.ref }}`: in a reusable workflow called from a
+          # pull_request, github.ref is the named merge ref
+          # `refs/pull/<n>/merge`, which actions/checkout cannot fetch
+          # ("couldn't find remote ref refs/pull/<n>/merge") — it broke 8/10
+          # governance jobs on every PR estate-wide. github.sha resolves to the
+          # same merge commit but is always fetchable.
+          ref: ${{ github.sha }}
       - name: RFC 9116 security.txt validation
         run: |
           SECTXT=""
@@ -830,7 +870,15 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: ${{ github.repository }}
-          ref: ${{ github.ref }}
+          # Pin to the concrete event SHA (the PR merge commit on
+          # pull_request, the pushed commit on push). Do NOT use
+          # `ref: ${{ github.ref }}`: in a reusable workflow called from a
+          # pull_request, github.ref is the named merge ref
+          # `refs/pull/<n>/merge`, which actions/checkout cannot fetch
+          # ("couldn't find remote ref refs/pull/<n>/merge") — it broke 8/10
+          # governance jobs on every PR estate-wide. github.sha resolves to the
+          # same merge commit but is always fetchable.
+          ref: ${{ github.sha }}
       - name: Check SPDX headers + permissions
         run: |
           failed=0
@@ -874,7 +922,15 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: ${{ github.repository }}
-          ref: ${{ github.ref }}
+          # Pin to the concrete event SHA (the PR merge commit on
+          # pull_request, the pushed commit on push). Do NOT use
+          # `ref: ${{ github.ref }}`: in a reusable workflow called from a
+          # pull_request, github.ref is the named merge ref
+          # `refs/pull/<n>/merge`, which actions/checkout cannot fetch
+          # ("couldn't find remote ref refs/pull/<n>/merge") — it broke 8/10
+          # governance jobs on every PR estate-wide. github.sha resolves to the
+          # same merge commit but is always fetchable.
+          ref: ${{ github.sha }}
           path: caller
       - name: Checkout standards (for the check script)
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -897,7 +953,15 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: ${{ github.repository }}
-          ref: ${{ github.ref }}
+          # Pin to the concrete event SHA (the PR merge commit on
+          # pull_request, the pushed commit on push). Do NOT use
+          # `ref: ${{ github.ref }}`: in a reusable workflow called from a
+          # pull_request, github.ref is the named merge ref
+          # `refs/pull/<n>/merge`, which actions/checkout cannot fetch
+          # ("couldn't find remote ref refs/pull/<n>/merge") — it broke 8/10
+          # governance jobs on every PR estate-wide. github.sha resolves to the
+          # same merge commit but is always fetchable.
+          ref: ${{ github.sha }}
           path: caller
       - name: Checkout standards (for the check script)
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0