ci: retire security-gate-pr-target; prune-stale drops deleted-workflow keys

.github/workflows/actions.lock

@@ -140,9 +140,6 @@ workflows:
         - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc'
     '.github/workflows/secret-scanner-reusable.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
-    '.github/workflows/security-gate-pr-target.yml':
-        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
-        - 'actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3'
     '.github/workflows/self-test.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
     '.github/workflows/settings-drift-detect.yml':

.hypatia-baseline.json

@@ -1148,15 +1148,6 @@
   "expires_at": "2026-12-22",
   "tracking_issue": "hyperpolymath/standards#942"
  },
- {
-  "severity": "warn",
-  "rule_module": "research_extensions",
-  "type": "RE005",
-  "file": ".github/workflows/security-gate-pr-target.yml",
-  "note": "TOLERATED PENDING CLASSIFICATION (hypatia triage 2026-09-22): flagged exit-masking step not yet reviewed; verify fail-closed-with-fallback or file a masking bug.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#942"
- },
  {
   "severity": "warn",
   "rule_module": "research_extensions",
@@ -1418,15 +1409,6 @@
   "expires_at": "2026-12-22",
   "tracking_issue": "hyperpolymath/standards#939"
  },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "download_then_run_shell",
-  "file": ".github/workflows/security-gate-pr-target.yml",
-  "note": "FALSE POSITIVE (hypatia triage 2026-09-22): rule matches the scanner's own detection patterns/comments in this file; no real download-then-run present (verified).",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#939"
- },
  {
   "severity": "medium",
   "rule_module": "content_patterns",

CICD-WORKFLOW-CATALOG.md

@@ -46,7 +46,7 @@ These workflows **block** merges if they fail. They enforce critical estate-wide
 | `main-estate-audit.yml` | Estate audit checks | rsr-template-repo | Yes |
 | `scorecard.yml` | OSSF Scorecard | rsr-template-repo | Yes |
 | `scorecard-reusable.yml` | Reusable Scorecard | standards | Yes |
-| `security-gate-pr-target.yml` | **NEW:** Security gate for fork PRs | standards | No |
+| ~~`security-gate-pr-target.yml`~~ | **RETIRED 2026-10-06:** the Actions policy blocks `pull_request_target`, so it never ran (startup_failure on every PR) | standards | No |
 | `estate-rules.yml` | Estate-wide conventions enforcement | rsr-template-repo | No |
 | `guix-policy.yml` | Guix/Nix package policy | knot-rider (canonical) | No |
 | `secret-scanner.yml` | Secrets detection | rsr-template-repo | Yes |
@@ -234,7 +234,6 @@ Use sparingly - only when certain it's a false positive.
 - [ ] `hypatia-scan.yml` - GATE
 - [ ] `secret-scanner.yml` - GATE
 - [ ] `main-estate-audit.yml` - GATE
-- [ ] `security-gate-pr-target.yml` - GATE (for fork PR security)
 - [ ] `check-suite-monitor.yml` - CHECK (for CI health monitoring)
 
 ### Recommended (Most Repos)