ci(security): SHA-pin standards/governance-reusable.yml from @main (#103)

Two governance.yml files invoke a reusable workflow via the floating
@main ref. SHA-pin to 1376eb6251fa9beeaea75241739b1d00dd6b4028
(standards main as of 2026-06-01) to prevent supply-chain drift.

Per estate [SHA-pin discipline] convention; the comment includes the
upstream branch name + date for human-readable bump reference.

Salvaged from the M1 foreign-WIP triage (where the same fix was
queued against an older SHA 861b5e911...).

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/governance.yml

@@ -31,4 +31,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@main
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@1376eb6251fa9beeaea75241739b1d00dd6b4028  # standards main 2026-06-01

alkahest-shell-transmuter/.github/workflows/governance.yml

@@ -23,4 +23,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@main
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@1376eb6251fa9beeaea75241739b1d00dd6b4028  # standards main 2026-06-01