ci: [repo] Adopt actions.lock — the workflow lockfile is absent (estate canon R2; rsr-template-repo ships one) #58

Umbrella: #53 (CI hygiene & estate-conformance top-up — 2026-10-10).

Evidence

find . -name actions.lock returns nothing: the repository has no .github/workflows/actions.lock. The estate canon (CICD-SIGNAL-DISCIPLINE "Estate canon — ratified 2026-09-02", MUST list) requires actions.lock present everywhere (R2), regenerated in the same PR as any uses: change; rsr-template-repo ships one at .github/workflows/actions.lock. PR #48's notes already recorded the absence ("The repo has no actions.lock").

Without it the repo relies solely on inline SHA pins (current state is honestly pinned — every uses: is an immutable SHA), but the estate lockfile discipline — and its check-lock-sync.sh gate, which is the authority over gh actions-lock --verify-local for job-level reusable-workflow refs — cannot run here.

Fix

Adopt the lock in the standard format (workflows: map + per-action ref/commit/owner_id/repo_id resolutions), generated to match the tree's uses: set exactly (including job-level reusable-workflow refs such as hyperpolymath/standards/.github/workflows/governance-reusable.yml@…), and verified with hyperpolymath/standards/scripts/check-lock-sync.sh. Future uses: changes must regenerate the lock in the same PR (e.g. Dependabot bumps like #52).

Acceptance criteria

• .github/workflows/actions.lock exists and check-lock-sync.sh passes against the workflow tree
• The lock covers job-level uses: (reusable workflow calls), not just step-level actions
• Every future PR that changes a uses: ref regenerates the lock in the same PR (process note; enforced by the lock-sync gate where installed)

Fixed in the follow-up PR on arena/cbd1e29d-smtlib-jl; closes when it merges.

References

standards/rhodium-standard-repositories/actions-allowlist/README.adoc, standards/scripts/check-lock-sync.sh (the authority: "gh-actions-lock … cannot be the authority. This script is."), standards/docs/DEPENDABOT-POLICY.adoc (lock repair rides with bumps).