Submodule pins drift to orphaned commits — re-pin done; harden against recurrence

[hyperpolymath]

Context

membership-integrity (in .github/workflows/anchor-drift.yml) was failing on main because several member submodule gitlinks pointed at commits that no longer exist on the member remotes — orphaned when those member repos' histories were rewritten (squash-merged PRs produce new SHAs). The job aborted with:

fatal: remote error: upload-pack: not our ref <sha>
fatal: Fetched in submodule path 'members/ci/a2ml-pre-commit', but it did not contain <sha>.

What was fixed

PR #14 (merged) re-pinned the 6 dangling in-scope members to each member's current origin/main HEAD so the recorded pins are reachable again:

a2ml-pre-commit, a2ml-deno, a2ml-haskell, a2ml-rs, pandoc-a2ml, vscode-a2ml

The same PR also switched the submodule-resolution step to a full (non-shallow) fetch so non-tip pins resolve. membership-integrity is now green.

Residual risk / why this recurs

Static gitlink pins re-orphan every time a member repo squash-merges or force-pushes, so the gate will silently go red again on the next member history rewrite. members/tooling/a2mliser is outside the current automation scope (it couldn't be re-pinned in the session that fixed the others) but resolved cleanly in CI.

Proposed (ties into #8 — member rollout)

• Decide a drift-resistant pin policy — e.g. pin members to tags/releases instead of branch-tip commits, or add a scheduled job that re-pins members/* to current main and opens a PR, or treat membership-integrity as the early-warning gate (it now catches this on every PR/push).
• Track the a2mliser pin under whoever owns that repo.

Refs #8.