fix: clear the three gates tripped by the lockfile adoption

.github/workflows/affinescript-verify.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: AffineScript Verify
 # Direct pushes only on integration branches. Feature-branch validation
 # is fully covered by pull_request — running a full AffineScript verify

.github/workflows/boj-build.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 #
 # OPTIONAL: BoJ Server Build Trigger
 # This workflow notifies a BoJ Server instance when code is pushed.

.github/workflows/casket-pages.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: GitHub Pages
 
 on:

.github/workflows/changelog-reusable.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath)
 #
 # changelog-reusable.yml — Generate CHANGELOG.md from conventional commits.

.github/workflows/changelog.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: Changelog
 
 on:

.github/workflows/codeql-reusable.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # codeql-reusable.yml — Reusable CodeQL security-analysis workflow.
 #
 # Consolidates the per-repo `codeql.yml` workflow (estate-wide: 263

.github/workflows/codeql.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: CodeQL Security Analysis
 
 on:

.github/workflows/deno-ci-reusable.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # deno-ci-reusable.yml — Reusable Deno CI bundle (RSR).
 #
 # Replaces the per-repo `rescript-deno-ci.yml` template that copy-drifted

.github/workflows/deno-ci.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: Deno CI
 
 on:

.github/workflows/doc-format.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: Documentation Format Enforcement
 
 on:

.github/workflows/dyadt-verify.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # dyadt-verify — DYADT dogfood. Verify this repo's CLAIMS.a2ml against primary
 # evidence, and run the DYADT conformance vector suite. If a claim this change
 # makes is false, the verifier REFUTES it and this job fails loudly.

.github/workflows/echidna-verify.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # ECHIDNA proof verification — formal verification of Agda and Idris2 proofs.
 #
 # Scope:

.github/workflows/elixir-ci-reusable.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # elixir-ci-reusable.yml — Reusable Elixir CI bundle (RSR).
 #
 # Replaces the per-repo `elixir-ci.yml` template that copy-drifted (and

.github/workflows/elixir-ci.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: Elixir CI
 
 on:

.github/workflows/governance-reusable.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Governance checks for hyperpolymath repositories — Reusable Workflow
 name: Governance Reusable Workflow
 

.github/workflows/governance.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: Governance
 
 on:

.github/workflows/hypatia-scan-reusable.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Hypatia Neurosymbolic CI/CD Security Scan — Reusable Workflow
 name: Hypatia Reusable Scan
 

.github/workflows/hypatia-scan.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: Hypatia Security Scan
 
 on:

.github/workflows/instant-sync.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Instant Forge Sync - Triggers propagation to all forges on push/release
 name: Instant Sync
 

.github/workflows/launcher-standard-lockstep.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: launcher-standard lock-step
 
 # Enforces the sync requirement declared in launcher/README.adoc §Sync

.github/workflows/makefile-blocker.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: Makefile Blocker
 
 on:

.github/workflows/mirror-reusable.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # mirror-reusable.yml — Reusable git-forge mirror bundle.
 #
 # Consolidates the per-repo `mirror.yml` workflow (estate-wide: 289

.github/workflows/mirror.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: Mirror to Git Forges
 
 on:

.github/workflows/no-js-scan.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: No-JS Scan (warn-first)
 
 # Estate policy: no hand-authored JavaScript/TypeScript source

.github/workflows/pages.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: GitHub Pages (Ddraig SSG)
 on:
   push:

.github/workflows/readme-derive-reusable.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # README single-source derivation — Reusable Workflow (ADR-004)
 #
 # Author READMEs once in AsciiDoc; derive README.md ONLY for repos that

.github/workflows/readme-derive.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: README Derive
 
 on:

.github/workflows/registry-verify.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # registry-verify — fail the build if the spec registry or the DERIVED
 # topology map has drifted from the file tree. This is the in-repo half of
 # the drift-detection loop (the estate half is Hypatia rule HYP-S006).

.github/workflows/rust-ci-reusable.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # rust-ci-reusable.yml — Reusable Rust CI bundle (RSR).
 #
 # Replaces the per-repo `rust-ci.yml` template that copy-drifted across

.github/workflows/rust-ci.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: Rust CI
 
 on:

.github/workflows/scorecard-enforcer.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Prevention workflow - runs OpenSSF Scorecard and fails on low scores
 name: OpenSSF Scorecard Enforcer
 

.github/workflows/scorecard-reusable.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: OSSF Scorecard Reusable Workflow
 
 on:

.github/workflows/scorecard.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: Scorecard
 
 on:

.github/workflows/secret-scanner-reusable.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # secret-scanner-reusable.yml — Reusable secret-scanner bundle.
 #
 # Consolidates the per-repo `secret-scanner.yml` workflow (estate-wide:

.github/workflows/secret-scanner.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: Secret Scanner
 
 on:

.github/workflows/self-test.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # self-test — run this repo's own test suite.
 #
 # WHY: `tests/test_check_trusted_base.sh` has existed for some time and was

.github/workflows/signed-push-smoke.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # End-to-end check for the signed-push composite action: pushes a throwaway commit
 # via the GitHub App and asserts GitHub marks it "Verified". Manual trigger only.
 # Requires repo/org secret APP_PRIVATE_KEY and variable APP_ID (the estate App).

.github/workflows/spark-theatre-gate.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: SPARK Theatre Gate
 
 # Estate anti-theatre lint (hyperpolymath/standards#135, sub-issue of #124).

scripts/check-allowed-actions.sh

@@ -37,7 +37,8 @@ def owner_repo(u):
     return '/'.join(parts[:2]), parts[0]
 
 def covered(u):
-    if u.startswith('./') or u.startswith('docker://'):
+    # $/ is gh actions-lock's inherently-pinned same-repo form (like ./)
+    if u.startswith('./') or u.startswith('$/') or u.startswith('docker://'):
         return True
     orp, owner = owner_repo(u)
     if owner in gh_owned:                       # github-owned (actions/*, github/*)

scripts/relock-sha-keys.sh

@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: MPL-2.0
+#
+# Re-key gh-actions-lock's tag-form lockfile entries back to the inline SHA
+# refs used in the workflow files.
+#
+# gh actions-lock prettifies `uses: owner/repo@<sha> # vX` to `owner/repo@vX`
+# and keys .github/workflows/actions.lock by that tag. This estate keeps
+# inline SHA pins in workflow files (Mustfile actions-sha-pinned, governance
+# workflow linter, hypatia rule, and GitHub's sha_pinning_required all enforce
+# them), so after every `gh actions-lock` regeneration:
+#
+#   1. restore the SHA-pinned workflow files (git checkout -- ...)
+#   2. run this script to re-key the lockfile to match
+#
+# Entries are only re-keyed when the recorded commit digest matches a SHA
+# actually written inline in a workflow file (subpath-aware: the lockfile
+# keys `github/codeql-action` while workflows may pin
+# `github/codeql-action/init@<sha>`). Transitive deps inside external
+# composites keep the ref form their composite wrote. Key SHA == commit
+# digest, which the lockfile format already supports.
+#
+# Usage: scripts/relock-sha-keys.sh [workflows-dir]   (default .github/workflows)
+
+set -euo pipefail
+wf_dir="${1:-.github/workflows}"
+
+python3 - "$wf_dir" <<'PY'
+import re
+import sys
+from pathlib import Path
+
+wf_dir = Path(sys.argv[1])
+lock_path = wf_dir / "actions.lock"
+text = lock_path.read_text()
+
+# Inline SHA refs from workflow files: repo root (lowercase) -> set of SHAs.
+uses_re = re.compile(r"uses:\s*([A-Za-z0-9_.-]+/[A-Za-z0-9_./-]+)@([0-9a-f]{40})")
+inline = {}
+for f in sorted(wf_dir.glob("*.yml")) + sorted(wf_dir.glob("*.yaml")):
+    for m in uses_re.finditer(f.read_text()):
+        root = "/".join(m.group(1).split("/")[:2]).lower()
+        inline.setdefault(root, set()).add(m.group(2))
+
+# Lockfile dependency entries: key 'action@ref' with commit 'sha1-<sha>'.
+entry_re = re.compile(r"^    '([^'@]+)@([^']+)':\n((?:^ {8}.*\n?)*)", re.MULTILINE)
+mapping = {}
+for m in entry_re.finditer(text):
+    action, ref, body = m.group(1), m.group(2), m.group(3)
+    if re.fullmatch(r"[0-9a-f]{40}", ref):
+        continue  # already SHA-keyed
+    cm = re.search(r"commit:\s*'sha1-([0-9a-f]{40})'", body)
+    if not cm:
+        continue
+    sha = cm.group(1)
+    if sha in inline.get(action.lower(), set()):
+        mapping[f"{action}@{ref}"] = f"{action}@{sha}"
+
+for old, new in mapping.items():
+    text = text.replace(f"'{old}'", f"'{new}'")
+
+lock_path.write_text(text)
+print(f"re-keyed {len(mapping)} entries:")
+for old, new in sorted(mapping.items()):
+    print(f"  {old} -> @{new.rsplit('@', 1)[1][:12]}")
+PY