fix(ci): unbreak workflow YAML and add a complete actions.lock

.github/workflows/abi-drift.yml

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # ABI Drift Gate (standards#92 Phase 2)
@@ -45,7 +46,7 @@ jobs:
     outputs:
       run: ${{ steps.detect.outputs.run }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@v6.0.2
         with:
           fetch-depth: 0
       - id: detect
@@ -70,15 +71,15 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@v6.0.2
         with:
           # Need at least two commits so `git diff origin/<base>...HEAD`
           # can compute the changed-cartridge set on pull_request events.
           # `0` = full history (cheap on this repo).
           fetch-depth: 0
 
       - name: Install Rust toolchain (stable)
-        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master
+        uses: dtolnay/rust-toolchain@v1
         with:
           toolchain: stable
 
@@ -90,7 +91,7 @@ jobs:
       # GADT-skip fix (iseriser#20, merged 2026-05-20) never reached CI.
       # Bumping ISERISER_REV invalidates the cache and forces a rebuild.
       - name: Cache cargo bin (iseriser install)
-        uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
+        uses: actions/cache@v4.2.2
         env:
           ISERISER_REV: 741a3b63e7619b6e9cfe7f91b04d7ccfb130b1ca
         with:

.github/workflows/actions.lock

@@ -3,10 +3,15 @@
 # Docs: https://gh.io/actions-lockfile
 version: 'v0.0.2'
 workflows:
+    '.github/workflows/governance.yml': []
+    '.github/workflows/mirror.yml': []
+    '.github/workflows/readme-derive.yml': []
+    '.github/workflows/scorecard.yml': []
+    '.github/workflows/secret-scanner.yml': []
     '.github/workflows/abi-drift.yml':
         - 'actions/cache@v4.2.2'
         - 'actions/checkout@v6.0.2'
-        - 'dtolnay/rust-toolchain@master'
+        - 'dtolnay/rust-toolchain@v1'
     '.github/workflows/backend-assurance.yml':
         - 'actions/cache@v4.2.2'
         - 'actions/checkout@v6.0.2'
@@ -29,7 +34,7 @@ workflows:
         - 'actions/upload-artifact@v4.6.2'
         - 'denoland/setup-deno@v2.0.4'
         - 'erlef/setup-beam@v1.24.0'
-        - 'goto-bus-stop/setup-zig@v2.0.0'
+        - 'mlugg/setup-zig@v2.2.1'
         - 'oven-sh/setup-bun@v2.2.0'
     '.github/workflows/fuzz.yml':
         - 'actions/checkout@v6.0.2'
@@ -46,7 +51,7 @@ workflows:
         - 'peter-evans/repository-dispatch@v3.0.0'
     '.github/workflows/lsp-dap-bsp.yml':
         - 'actions/checkout@v6.0.2'
-        - 'goto-bus-stop/setup-zig@v2.0.0'
+        - 'mlugg/setup-zig@v2.2.1'
     '.github/workflows/pages-deploy.yml':
         - 'actions/checkout@v4.4.0'
     '.github/workflows/pages.yml':
@@ -70,7 +75,7 @@ workflows:
         - 'softprops/action-gh-release@v2.6.2'
     '.github/workflows/truthfulness.yml':
         - 'actions/checkout@v6.0.2'
-        - 'goto-bus-stop/setup-zig@v2.0.0'
+        - 'mlugg/setup-zig@v2.2.1'
     '.github/workflows/zig-test.yml':
         - 'actions/checkout@v6.0.2'
         - 'mlugg/setup-zig@v2.2.1'
@@ -152,17 +157,17 @@ dependencies:
             - 'actions/upload-artifact@v4'
     'dawidd6/action-send-mail@v3.12.0':
         ref: 'v3.12.0'
-        commit: 'sha1-6e502825a508b867ab2954ad6343b68787624c01'
+        commit: 'sha1-2cea9617b09d79a095af21254fbcb7ae95903dde'
         owner_id: 9713907
         repo_id: 222439721
     'denoland/setup-deno@v2.0.4':
         ref: 'v2.0.4'
         commit: 'sha1-667a34cdef165d8d2b2e98dde39547c9daac7282'
         owner_id: 42048915
         repo_id: 356423100
-    'dtolnay/rust-toolchain@master':
-        ref: 'master'
-        commit: 'sha1-b3b07ba8b418998c39fb20f53e8b695cdcc8de1b'
+    'dtolnay/rust-toolchain@v1':
+        ref: 'v1'
+        commit: 'sha1-6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772'
         owner_id: 1940490
         repo_id: 260749683
     'erlef/setup-beam@v1.24.0':
@@ -180,11 +185,6 @@ dependencies:
         commit: 'sha1-c6f931105cb2c34c8f901cc885ba1e2e259cf745'
         owner_id: 9919
         repo_id: 259445878
-    'goto-bus-stop/setup-zig@v2.0.0':
-        ref: 'v2.0.0'
-        commit: 'sha1-9566bb3e8749893055694249726756f25e099b30'
-        owner_id: 1006268
-        repo_id: 212984112
     'mlugg/setup-zig@v2.2.1':
         ref: 'v2.2.1'
         commit: 'sha1-d1434d08867e3ee9daa34448df10607b98908d29'

.github/workflows/backend-assurance.yml

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # Backend-Assurance Harness (epic #87 Tier C)
@@ -46,7 +47,7 @@ jobs:
     outputs:
       run: ${{ steps.detect.outputs.run }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@v6.0.2
         with:
           fetch-depth: 0
       - id: detect
@@ -78,16 +79,16 @@ jobs:
       run:
         working-directory: elixir
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@v6.0.2
 
       - name: Set up BEAM (Elixir + OTP)
-        uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1.24.0
+        uses: erlef/setup-beam@v1.24.0
         with:
           elixir-version: '1.18.4'
           otp-version: '27.0'
 
       - name: Cache deps + _build
-        uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
+        uses: actions/cache@v4.2.2
         with:
           path: |
             elixir/deps

.github/workflows/build.yml

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # SonarQube Cloud (SonarCloud) static analysis. Generated from the SonarCloud
@@ -21,10 +22,10 @@ jobs:
     name: SonarQube
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@v4.3.1
         with:
           fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
       - name: SonarQube Scan
-        uses: SonarSource/sonarqube-scan-action@7006c4492b2e0ee0f816d36501671557c97f5995 # v8.1.0
+        uses: SonarSource/sonarqube-scan-action@v8.1.0
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.github/workflows/codeql.yml

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: CodeQL Security Analysis
 
 on:
@@ -42,15 +43,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v6.0.2
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v4.34.0
+        uses: github/codeql-action/init@v4.34.0
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v4.34.0
+        uses: github/codeql-action/analyze@v4.34.0
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/container-publish.yml

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # Container Publish workflow — builds and pushes the container image to
@@ -27,7 +28,7 @@ jobs:
       id-token: write       # mint the OIDC token the attestation is signed with
       attestations: write   # write the build-provenance attestation (the "claim")
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@v6.0.2
 
       - name: Extract version metadata
         id: meta
@@ -92,7 +93,7 @@ jobs:
       #   gh attest verify oci://ghcr.io/${{ github.repository }}:<tag> \
       #     --repo ${{ github.repository }}
       - name: Attest container provenance
-        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
+        uses: actions/attest-build-provenance@v2.4.0
         with:
           subject-name: ghcr.io/${{ github.repository }}
           subject-digest: ${{ steps.push.outputs.digest }}

.github/workflows/dogfood-gate.yml

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # dogfood-gate.yml — Hyperpolymath Dogfooding Quality Gate
@@ -36,7 +37,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v6.0.2
 
       - name: Check for A2ML files
         id: detect
@@ -77,7 +78,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v6.0.2
 
       - name: Check for K9 files
         id: detect
@@ -123,7 +124,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v6.0.2
 
       - name: Scan for invisible characters
         id: lint
@@ -191,7 +192,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v6.0.2
 
       - name: Check for Groove manifest
         id: groove
@@ -250,7 +251,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v6.0.2
 
       - name: Check and validate eclexiaiser manifest
         id: eclex
@@ -298,7 +299,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v6.0.2
 
       - name: Generate dogfooding scorecard
         run: |