fix(governance): enforce live Actions policy

[hyperpolymath]

Summary

Closes #486.

• make check-actions-policy.sh inspect the live repository policy rather than duplicating the tree scanner
• reject disabled Actions, SHA pinning off, empty selected policies, and selected policies that are not canonical supersets
• extend set-allowed-actions.sh to apply the recorded default (all + mandatory SHA pinning), retain a selected high-sensitivity mode, escalate repo → org → enterprise, and verify every write through a GET
• run both tree and live checks from governance and ship the promised standalone reusable workflow
• integrate the live requirement into the RSR profile/self-audit entrypoints
• add root and task Just recipes, lock coverage, and corrected policy documentation

The live hyperpolymath/standards setting was corrected from selected + sha_pinning_required=false to the issue's decision of record:

{"enabled":true,"allowed_actions":"all","sha_pinning_required":true}

The PUT was followed immediately by that GET response; no estate-wide/org policy was changed.

Verification

• scripts/tests/actions-policy-486-test.sh: 11/11 pass, covering all/selected compliance, pinning-off, disabled Actions, empty/missing selected entries, setter read-back reset refusal, selected setter mode, and RSR pass/fail behavior
• workflow-equivalent discovery: 26/26 shell test files pass
• ShellCheck passes on all five touched/new shell files
• all three touched/new workflows parse with yq
• new reusable workflow has complete gh actions-lock --verify-local coverage
• tree allowlist scan: 32 references, 0 gaps
• just validate passes
• git diff --check passes

Token note

The reusable accepts HYPATIA_SCAN_PAT (the existing standards secret) for Administration-read access and falls back to github.token. The local governance caller uses secrets: inherit; cross-repository callers can explicitly map that secret.

[gitar-bot]

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

_Gitar

[hyperpolymath]

CI credential diagnosis (2026-08-24): the new live policy check is working and failing closed. HYPATIA_SCAN_PAT reaches the Administration-read endpoint with HTTP 401 (expired/invalid); the valid built-in github.token reaches the same endpoint with HTTP 403 (Resource not accessible by integration). The repository live policy itself was independently read and corrected to {enabled:true, allowed_actions:"all", sha_pinning_required:true}. Code cannot safely mint or recover an Administration-read secret, so this PR now keeps the PAT dependency explicit rather than degrading to a tree-only pass. Maintainer action required: rotate HYPATIA_SCAN_PAT with repository Administration:read, then rerun. Static preflight: 32 refs checked, 0 allowlist gaps. Local regression suite: 11/11 policy cases; full repo shell suite: 26/26.

[sonarqubecloud]

Quality Gate passed

Issues
27 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud