ci: adopt standards SLSA allowlist repair

.github/workflows/fork-governance-publish.yml

@@ -187,7 +187,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          gh api 'repos/metadatastician/standards/contents/scripts/fork-governance-render.sh?ref=34cf03f988b8ca95b91b45d9b3351f7d3babfb65' \
+          gh api 'repos/metadatastician/standards/contents/scripts/fork-governance-render.sh?ref=857ff096af11451841fb10488fed1438523973a1' \
             --jq .content | base64 -d > "$RUNNER_TEMP/trusted-renderer.sh"
 
       - name: Render and publish the verified run's summary

.github/workflows/fork-governance.yml

@@ -2,7 +2,7 @@
 # fork-governance.yml — the estate conformance lanes on every pull request,
 # adopted per metadatastician/standards 3-practice/fork-governance/ADOPTION.adoc
 # at the same standards commit every other reusable in this repo pins
-# (34cf03f…). Scans here; fork-governance-publish.yml posts one comment:
+# (857ff096af11451841fb10488fed1438523973a1). Scans here; fork-governance-publish.yml posts one comment:
 #
 # CANONICAL COORDINATES (2026-10-28 repair). `standards` was transferred from
 # the `hyperpolymath` user account to the `metadatastician` organisation on
@@ -52,15 +52,15 @@ permissions:
 jobs:
   deed:
     name: DEED syntax
-    uses: metadatastician/standards/.github/workflows/deed-conformance.yml@34cf03f988b8ca95b91b45d9b3351f7d3babfb65
+    uses: metadatastician/standards/.github/workflows/deed-conformance.yml@857ff096af11451841fb10488fed1438523973a1
     permissions:
       contents: read
     with:
       require-files: true
 
   k9:
     name: K9-DEED conformance
-    uses: metadatastician/standards/.github/workflows/k9-conformance.yml@34cf03f988b8ca95b91b45d9b3351f7d3babfb65
+    uses: metadatastician/standards/.github/workflows/k9-conformance.yml@857ff096af11451841fb10488fed1438523973a1
     permissions:
       contents: read
       pull-requests: read
@@ -88,7 +88,7 @@ jobs:
     # orange fleet rows, never as a missing lane.
     needs: [fleet]
     if: ${{ always() }}
-    uses: metadatastician/standards/.github/workflows/hypatia-scan-reusable.yml@34cf03f988b8ca95b91b45d9b3351f7d3babfb65
+    uses: metadatastician/standards/.github/workflows/hypatia-scan-reusable.yml@857ff096af11451841fb10488fed1438523973a1
     permissions:
       actions: read
       contents: read

.github/workflows/governance.yml

@@ -29,7 +29,7 @@ jobs:
     permissions:
       actions: read
       contents: read
-    uses: metadatastician/standards/.github/workflows/governance-reusable.yml@34cf03f988b8ca95b91b45d9b3351f7d3babfb65
+    uses: metadatastician/standards/.github/workflows/governance-reusable.yml@857ff096af11451841fb10488fed1438523973a1
     with:
       # Strictest baseline mode: if a .hypatia-baseline.json acknowledgement
       # ever lands here it must carry an expires_at, or this fails. (The repo

.github/workflows/hypatia-scan.yml

@@ -34,7 +34,7 @@ jobs:
       actions: read
       contents: read
       security-events: write
-    uses: metadatastician/standards/.github/workflows/hypatia-scan-reusable.yml@34cf03f988b8ca95b91b45d9b3351f7d3babfb65
+    uses: metadatastician/standards/.github/workflows/hypatia-scan-reusable.yml@857ff096af11451841fb10488fed1438523973a1
     secrets:
       # Same declared-secret shape as the PR lane: without it the alert
       # meta-rules fall back to the built-in token, which cannot read

.github/workflows/mirror.yml

@@ -18,7 +18,7 @@ jobs:
     permissions:
       actions: read
       contents: read
-    uses: metadatastician/standards/.github/workflows/mirror-reusable.yml@34cf03f988b8ca95b91b45d9b3351f7d3babfb65
+    uses: metadatastician/standards/.github/workflows/mirror-reusable.yml@857ff096af11451841fb10488fed1438523973a1
     secrets:
       GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }}
       BITBUCKET_SSH_KEY: ${{ secrets.BITBUCKET_SSH_KEY }}

.github/workflows/scorecard.yml

@@ -30,4 +30,4 @@ jobs:
       contents: read
       id-token: write
       security-events: write
-    uses: metadatastician/standards/.github/workflows/scorecard-reusable.yml@34cf03f988b8ca95b91b45d9b3351f7d3babfb65
+    uses: metadatastician/standards/.github/workflows/scorecard-reusable.yml@857ff096af11451841fb10488fed1438523973a1

.github/workflows/secret-scanner.yml

@@ -25,4 +25,4 @@ jobs:
     # re-resolves every reusable pin on each run.
     permissions:
       contents: read
-    uses: metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@34cf03f988b8ca95b91b45d9b3351f7d3babfb65
+    uses: metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@857ff096af11451841fb10488fed1438523973a1