fix(gate-attestation): pin hybrid-gate.yml call to a SHA, closing the lint-debt gap

[forkwright]

What was wrong

kanon lint carried one live violation on main: SHELL/unpinned-action on
.github/workflows/gate-attestation.yml:88 — the reusable-workflow call to
forkwright/.github/.github/workflows/hybrid-gate.yml used a mutable @main
ref instead of a pinned commit SHA. The gate fails on any warning by default,
so this alone blocked kanon gate --stamp for every PR.

Re-verified premise, corrected

The literal 12-entry .kanon-lint-baseline.toml this issue was filed against
(remove_after = "2026-08-13") no longer exists on main — PR #86 (merged
2026-08-09) already resolved every one of those entries plus 7 unbaselined
findings and deleted the baseline file. kanon lint . against a fresh
origin/main checkout confirms this: none of the original rule families
(RUST/file-too-long, RUST/indexing-slicing, NAMING/no-owner-prefix,
RUST/no-silent-result-swallow, RUST/no-debug-derive-on-public-types,
COMMENTS/deflection-without-tracking, RUST/primitive-for-domain-id,
RUST/non-exhaustive-enum, RUST/config-deny-unknown-fields) fire anymore.
crates/hamma-core is crates/mitos now, so the specific
NAMING/no-owner-prefix entry this issue's follow-up note asked about is
already gone with it — nothing left to carry forward in a new baseline.

What #86 did not catch was SHELL/unpinned-action on the reusable-workflow
call itself, which is the one violation still blocking the gate today. This
PR closes that gap so #57's actual acceptance criterion — kanon lint .
clean on main — is met, with no baseline file needed at all.

What changed

• SHELL/unpinned-action: pin forkwright/.github/.github/workflows/hybrid-gate.yml
  to its current main SHA (df92942bcc41cc7ffd0339b75b2f01e52269d0ef),
  matching the convention already used by typikon and thumos (SHA + a
  trailing # main comment, plus a WHY comment documenting the refresh
  command).
• Adjacent drift, same class: .kanon-lint-ignore still carried
  RUST/pub-visibility:crates/dictyon/src/control.rs and .../noise.rs from
  before both modules split into control/mod.rs / noise/mod.rs (the same
  split wire.rs already went through, whose ignore entry is already a
  glob). The stale entries matched no file and silently suppressed nothing;
  kanon lint warned about both on every run. Re-globbed to match the
  current layout.

Verification

$ kanon lint .
0 error(s), 0 warning(s), 0 info (9 suppressed)

$ kanon gate --tier nobuild
PASS  config check
PASS  advisory ignore parity
PASS  derive check (deterministic)
PASS  fleet-names freshness
PASS  cargo fmt
PASS  kanon lint
ok  light gate passed — push to the forge for authoritative clippy + nextest + verifier

--tier nobuild is the local-verifiable slice (zero rustc invocations, per
this box's compile-on-CI-only posture); cargo build/clippy/nextest run on
this PR's GitHub Actions checks, which is what actually gates merge.

No Rust source changed — YAML and .kanon-lint-ignore only.

Closes #57