fix(ci): unbreak workflow YAML and add a complete actions.lock

.github/workflows/actions.lock

@@ -3,29 +3,49 @@
 # Docs: https://gh.io/actions-lockfile
 version: 'v0.0.2'
 workflows:
+    '.github/workflows/governance.yml': []
+    '.github/workflows/hypatia-scan.yml': []
+    '.github/workflows/mirror.yml': []
+    '.github/workflows/rust-ci.yml': []
+    '.github/workflows/scorecard.yml': []
+    '.github/workflows/secret-scanner.yml': []
     '.github/workflows/boj-build.yml':
         - 'actions/checkout@v4.1.7'
     '.github/workflows/bridge-gate.yml':
         - 'actions/checkout@v4.3.1'
-    '.github/workflows/cargo-audit.yml': []
+    '.github/workflows/cargo-audit.yml':
+        - 'actions/checkout@v5.0.1'
+        - 'dtolnay/rust-toolchain@v1'
     '.github/workflows/casket-pages.yml':
         - 'actions/cache@v4.3.0'
         - 'actions/checkout@v4.1.1'
         - 'actions/configure-pages@v5.0.0'
         - 'actions/deploy-pages@v4.0.5'
         - 'actions/upload-pages-artifact@v3.0.1'
         - 'haskell-actions/setup@v2.7.5'
-    '.github/workflows/chapel-ci.yml': []
+    '.github/workflows/chapel-ci.yml':
+        - 'actions/cache@v4.3.0'
+        - 'actions/checkout@v6.0.2'
+        - 'actions/download-artifact@v4.1.8'
+        - 'actions/upload-artifact@v4.6.2'
+        - 'dtolnay/rust-toolchain@v1'
     '.github/workflows/codeql.yml':
         - 'actions/checkout@v6.0.2'
         - 'github/codeql-action@v4.34.0'
-    '.github/workflows/coverage.yml': []
+    '.github/workflows/coverage.yml':
+        - 'actions/checkout@v5.0.1'
+        - 'codecov/codecov-action@v5.5.2'
+        - 'dtolnay/rust-toolchain@v1'
     '.github/workflows/dependency-review.yml':
         - 'actions/checkout@v5.0.1'
         - 'actions/dependency-review-action@v4.3.4'
     '.github/workflows/dogfood-gate.yml':
         - 'actions/checkout@v4.3.1'
-    '.github/workflows/e2e.yml': []
+    '.github/workflows/e2e.yml':
+        - 'actions/checkout@v4.3.1'
+        - 'actions/upload-artifact@v4.6.2'
+        - 'dtolnay/rust-toolchain@v1'
+        - 'swatinem/rust-cache@v2.8.2'
     '.github/workflows/instant-sync.yml':
         - 'peter-evans/repository-dispatch@v4.0.1'
     '.github/workflows/pages.yml':
@@ -34,8 +54,17 @@ workflows:
         - 'actions/upload-pages-artifact@v3.0.1'
     '.github/workflows/push-email-notify.yml':
         - 'dawidd6/action-send-mail@v3.12.0'
-    '.github/workflows/release.yml': []
-    '.github/workflows/scan-and-report.yml': []
+    '.github/workflows/release.yml':
+        - 'actions/checkout@v5.0.1'
+        - 'actions/download-artifact@v4.1.8'
+        - 'actions/upload-artifact@v4.6.2'
+        - 'dtolnay/rust-toolchain@v1'
+        - 'softprops/action-gh-release@v2.5.0'
+        - 'swatinem/rust-cache@v2.8.2'
+    '.github/workflows/scan-and-report.yml':
+        - 'actions/checkout@v4.3.1'
+        - 'dtolnay/rust-toolchain@v1'
+        - 'swatinem/rust-cache@v2.8.2'
 dependencies:
     'actions/cache@v4.3.0':
         ref: 'v4.3.0'
@@ -87,23 +116,50 @@ dependencies:
         commit: 'sha1-d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e'
         owner_id: 44036562
         repo_id: 438112499
+    'actions/download-artifact@v4.1.8':
+        ref: 'v4.1.8'
+        commit: 'sha1-fa0a91b85d4f404e444e00e005971372dc801d16'
+        owner_id: 44036562
+        repo_id: 192626254
+    'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea':
+        ref: 'v7.0.1'
+        commit: 'sha1-60a0d83039c74a4aee543508d2ffcb1c3799cdea'
+        owner_id: 44036562
+        repo_id: 205262760
     'actions/upload-artifact@v4':
         ref: 'v4'
         commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
         owner_id: 44036562
         repo_id: 192625955
+    'actions/upload-artifact@v4.6.2':
+        ref: 'v4.6.2'
+        commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
+        owner_id: 44036562
+        repo_id: 192625955
     'actions/upload-pages-artifact@v3.0.1':
         ref: 'v3.0.1'
         commit: 'sha1-56afc609e74202658d3ffba0e8f6dda462b719fa'
         owner_id: 44036562
         repo_id: 496012378
         uses:
             - 'actions/upload-artifact@v4'
+    'codecov/codecov-action@v5.5.2':
+        ref: 'v5.5.2'
+        commit: 'sha1-671740ac38dd9b0130fbe1cec585b89eea48d3de'
+        owner_id: 8226205
+        repo_id: 200299178
+        uses:
+            - 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea'
     'dawidd6/action-send-mail@v3.12.0':
         ref: 'v3.12.0'
         commit: 'sha1-6e502825a508b867ab2954ad6343b68787624c01'
         owner_id: 9713907
         repo_id: 222439721
+    'dtolnay/rust-toolchain@v1':
+        ref: 'v1'
+        commit: 'sha1-6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772'
+        owner_id: 1940490
+        repo_id: 260749683
     'github/codeql-action@v4.34.0':
         ref: 'v4.34.0'
         commit: 'sha1-c6f931105cb2c34c8f901cc885ba1e2e259cf745'
@@ -119,3 +175,13 @@ dependencies:
         commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697'
         owner_id: 18365890
         repo_id: 220359305
+    'softprops/action-gh-release@v2.5.0':
+        ref: 'v2.5.0'
+        commit: 'sha1-a06a81a03ee405af7f2048a818ed3f03bbf83c7b'
+        owner_id: 2242
+        repo_id: 204253808
+    'swatinem/rust-cache@v2.8.2':
+        ref: 'v2.8.2'
+        commit: 'sha1-779680da715d629ac1d338a641029a2f4372abb5'
+        owner_id: 580492
+        repo_id: 298565987

.github/workflows/boj-build.yml

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: BoJ Server Build Trigger
 on:
   push:

.github/workflows/bridge-gate.yml

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Copyright (c) 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 #
 # bridge-gate.yml -- merge-orchestration CVE/bump gate.

.github/workflows/cargo-audit.yml

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Security Audit
 
 on:
@@ -23,7 +24,7 @@ jobs:
         uses: actions/checkout@v5.0.1
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
+        uses: dtolnay/rust-toolchain@v1
         with:
           toolchain: stable
 

.github/workflows/casket-pages.yml

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: GitHub Pages
 
 on:

.github/workflows/chapel-ci.yml

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 #
 # chapel-ci — strict CI gates for the OPTIONAL Chapel mass-panic harness.
 #
@@ -220,7 +221,7 @@ jobs:
     timeout-minutes: 45
     steps:
       - uses: actions/checkout@v6.0.2
-      - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
+      - uses: dtolnay/rust-toolchain@v1
       - uses: actions/cache@v4.3.0
         with:
           path: |
@@ -241,7 +242,7 @@ jobs:
     timeout-minutes: 45
     steps:
       - uses: actions/checkout@v6.0.2
-      - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
+      - uses: dtolnay/rust-toolchain@v1
       - uses: actions/cache@v4.3.0
         with:
           path: |

.github/workflows/codeql.yml

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: CodeQL Security Analysis
 
 on:

.github/workflows/coverage.yml

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Code Coverage
 
 on:
@@ -21,7 +22,7 @@ jobs:
         uses: actions/checkout@v5.0.1
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
+        uses: dtolnay/rust-toolchain@v1
         with:
           toolchain: stable
           components: llvm-tools-preview

.github/workflows/dependency-review.yml

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Dependency Review
 
 on:

.github/workflows/dogfood-gate.yml

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # dogfood-gate.yml — Hyperpolymath Dogfooding Quality Gate

.github/workflows/e2e.yml

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # End-to-end test suite for panic-attack.
@@ -41,7 +42,7 @@ jobs:
         uses: actions/checkout@v4.3.1
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7  # stable
+        uses: dtolnay/rust-toolchain@v1
 
       - name: Rust cache
         uses: Swatinem/rust-cache@v2.8.2
@@ -62,7 +63,7 @@ jobs:
         uses: actions/checkout@v4.3.1
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7  # stable
+        uses: dtolnay/rust-toolchain@v1
 
       - name: Rust cache
         uses: Swatinem/rust-cache@v2.8.2
@@ -126,7 +127,7 @@ jobs:
         uses: actions/checkout@v4.3.1
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7  # stable
+        uses: dtolnay/rust-toolchain@v1
 
       - name: Rust cache
         uses: Swatinem/rust-cache@v2.8.2
@@ -145,7 +146,7 @@ jobs:
         uses: actions/checkout@v4.3.1
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7  # stable
+        uses: dtolnay/rust-toolchain@v1
 
       - name: Rust cache
         uses: Swatinem/rust-cache@v2.8.2

.github/workflows/governance.yml

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Governance
 
 on:
@@ -10,8 +11,9 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a

.github/workflows/hypatia-scan.yml

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Hypatia Security Scan
 
 on:
@@ -12,9 +13,10 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
   security-events: write
 
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a

.github/workflows/instant-sync.yml

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Instant Forge Sync - Triggers propagation to all forges on push/release
 name: Instant Sync
 

.github/workflows/mirror.yml

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Mirror to Git Forges
 
 on:
@@ -8,9 +9,10 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
   mirror:
-    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a
     secrets: inherit

.github/workflows/pages.yml

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: GitHub Pages (Ddraig SSG)
 on:
   push:

.github/workflows/push-email-notify.yml

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Dormant push-email notification. ARMED by setting the repo variable
 # PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled;
 # sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by

.github/workflows/release.yml

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # Release workflow — triggered by version tags (v*).
@@ -28,7 +29,7 @@ jobs:
       - uses: actions/checkout@v5.0.1
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
+        uses: dtolnay/rust-toolchain@v1
         with:
           toolchain: stable
 

.github/workflows/rust-ci.yml

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Rust CI — thin wrapper calling the shared estate reusable in
 # hyperpolymath/standards. Configure once, propagate everywhere.
 # See: docs/CI-REUSABLE-WORKFLOWS.adoc in standards.
@@ -11,8 +12,9 @@ on:
   pull_request:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
   rust-ci:
-    uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@7c9db0e5909aab77bf11a444ade3b95c1d2b702e # re-pinned 2026-07-01: toolchain-required-input fix (standards#439)
+    uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a # re-pinned 2026-07-01: toolchain-required-input fix (standards#439)