fix(governance): SPDX header + SHA pins in pages.yml, refresh stale standards pins

Both Governance failures on this branch are the same two faults found and fixed
in krl (#56), so the same remedy applies here.

Workflow security linter

  * pages.yml carried no SPDX header. Every other workflow in the repo has one;
    this was the only omission. Added.
  * pages.yml used floating tags where every other workflow pins by SHA:
      actions/checkout@v7             -> 3d3c42e5... # v7
      actions/upload-pages-artifact@v5 -> fc324d35... # v5
      actions/deploy-pages@v5         -> cd2ce8fc... # v5
    Kept on the same major versions, so this changes pinning only, not
    behaviour.

Check Workflow Staleness

  * governance-reusable.yml, hypatia-scan-reusable.yml and
    scorecard-reusable.yml were pinned at d7c22711e830 — 63 commits / 24 days
    behind standards HEAD, outside the gate's recency window. Refreshed to
    f9dca6ded2cad8ab54044c1cb0489b558ae2682b (full 40-char SHA).

Not touched: mirror-reusable.yml (d135b05) and secret-scanner-reusable.yml
(c65436e). Neither was flagged, and the secret-scanner pin should not move
independently of the gitleaks allowlist work.

Verified: all workflows carry an SPDX header; no unpinned third-party actions
remain; actionlint 0 errors.

Author: hyperpolymath

.github/workflows/governance.yml

@@ -13,4 +13,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@f9dca6ded2cad8ab54044c1cb0489b558ae2682b

.github/workflows/hypatia-scan.yml

@@ -16,4 +16,4 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@f9dca6ded2cad8ab54044c1cb0489b558ae2682b

.github/workflows/pages.yml

@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 name: GitHub Pages (Ddraig SSG)
 on:
   push:
@@ -18,9 +20,9 @@ jobs:
       image: ghcr.io/stefan-hoeck/idris2-pack@sha256:f0758996a931fb35d9ecb1de273c4d59dabe2a09b433afc7e357f65a08b7e1ff
     steps:
       - name: Checkout Site
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Checkout Ddraig SSG
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           repository: hyperpolymath/ddraig-ssg
           path: .ddraig-ssg
@@ -37,7 +39,7 @@ jobs:
           fi
           ./.ddraig-ssg/build/exec/ddraig build src _site https://hyperpolymath.github.io/${GITHUB_REPOSITORY#*/}
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v5
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5
         with:
           path: '_site'
   deploy:
@@ -50,4 +52,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5

.github/workflows/scorecard.yml

@@ -13,7 +13,7 @@ permissions:
 
 jobs:
   scorecard:
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@f9dca6ded2cad8ab54044c1cb0489b558ae2682b
     permissions:
       contents: read
       security-events: write