Merge origin/main into proofs/q5-propositional-equiv-restructure

Resolves 17 conflicts. Main wins all 16 workflow files (PR #153-#155
hardening supersedes this branch's CI edits: valid pins, job-level
timeouts, pruned CodeQL languages, provers already landed via main).
Branch keeps the contractiles restructure incl. deletion of the old
contractiles/ tree.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: hyperpolymath

.claude/CLAUDE.md

@@ -1,5 +1,5 @@
 <!--
-SPDX-License-Identifier: MPL-2.0
+SPDX-License-Identifier: CC-BY-SA-4.0
 Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 -->
 ## Canonical bridge — READ FIRST

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,5 +1,5 @@
 <!--
-SPDX-License-Identifier: MPL-2.0
+SPDX-License-Identifier: CC-BY-SA-4.0
 Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 -->
 # proven Integration Plan

.github/ISSUE_TEMPLATE/custom.md

@@ -8,9 +8,10 @@ on:
 jobs:
   trigger-boj:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@1cce3390c2bfda521930d01229c073c7ff920824 # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6.0.2
       - name: Trigger BoJ Server (Casket/ssg-mcp)
         run: |
           # Send a secure trigger to boj-server to build this repository

.github/ISSUE_TEMPLATE/documentation.md

@@ -30,7 +30,8 @@ jobs:
   check:
     name: docs/ECHO-TYPES-OCHRANCE-BRIDGE forbidden-phrases
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
-      - uses: actions/checkout@1cce3390c2bfda521930d01229c073c7ff920824 # v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
       - name: Run forbidden-phrases checker
         run: bash .github/scripts/check-bridge-forbidden-phrases.sh

.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,44 +1,53 @@
 # SPDX-License-Identifier: MPL-2.0
 name: GitHub Pages
-timeout-minutes: 30
+
 on:
   push:
     branches: [main]
   workflow_dispatch:
+
 permissions:
   contents: read
   pages: write
   id-token: write
+
 concurrency:
   group: "pages"
   cancel-in-progress: false
+
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@1cce3390c2bfda521930d01229c073c7ff920824 # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
+
       - name: Checkout casket-ssg
-        uses: actions/checkout@1cce3390c2bfda521930d01229c073c7ff920824 # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
         with:
           repository: hyperpolymath/casket-ssg
           path: .casket-ssg
+
       - name: Setup GHCup
-        uses: haskell-actions/setup@f9150cb1d140e9a9271700670baa38991e6fa25c # v2
+        uses: haskell-actions/setup@cd0d9bdd65b20557f41bea4dbe43d0b5fbbfe553 # v2
         with:
           ghc-version: '9.8.2'
           cabal-version: '3.10'
+
       - name: Cache Cabal
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v4
         with:
           path: |
             ~/.cabal/packages
             ~/.cabal/store
             .casket-ssg/dist-newstyle
           key: ${{ runner.os }}-casket-${{ hashFiles('.casket-ssg/casket-ssg.cabal') }}
+
       - name: Build casket-ssg
         working-directory: .casket-ssg
         run: cabal build
+
       - name: Build site
         run: |
           mkdir -p site _site
@@ -69,17 +78,21 @@ jobs:
             fi
           fi
           cd .casket-ssg && cabal run casket-ssg -- build ../site ../_site
+
       - name: Setup Pages
         uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: '_site'
+
   deploy:
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     needs: build
     steps:
       - name: Deploy to GitHub Pages