fix(ci): restore deterministic organization config validation

[ss-o]

Summary

Restore deterministic validation for the organization CI, configuration, starter-template, and issue-form surfaces under the approved Track A v2 plan.

Baseline:

• Commit: 9dab73078d0c476892693e0d0c45843398a137d1
• Tree: e9c6a55c98f957400ba37297a1d2dbf27e9cd7f4
• Plan SHA-256: 7d316fa04a93dbe406c3ca590dddf5b8d19853fc0fd54f39fa4cb586ae4027e4
• Profile: core+metrics

Verified findings

• .trunk/trunk.yaml declares Go 1.21.0, while its Gitleaks 8.30.1 build silently selected Go 1.25.13. A qualified Go 1.26.6 candidate built Gitleaks with the declared toolchain and passed the default-rule functional canary.
• Archive-only full-repository Trunk checks cannot run git-diff-check; Track A requires a marker-protected task-owned real Git fixture.
• workflow-templates/project-tracker.properties.json is orphaned after the deliberate Linear transition.
• .github/workflows/static.yml deploys the whole repository and uses mutable action references without an owning runbook or issue.
• Four issue forms contain policy or governance links that no longer resolve.
• Renovate guidance still uses the legacy baseBranches key and a stale ADR-0004 status statement.

Accepted boundaries

• Runtime repair and repository self-validation are owned by this Track A issue.
• Renovate hosted processing and live dependency-security settings remain under chore(deps): migrate repositories to hybrid Renovate ownership #452.
• Repository-by-repository CI target-policy and ruleset rollout remains under Review proposed organization ADRs 0008–0010 for acceptance #454.
• Scheduled-workflow retention, staggering, and disabled-workflow policy remain under ops: rationalize scheduled workflows and recurring organization maintenance #485.
• Trunk plugin v1.11.0 evaluation is a follow-up and is not part of the runtime repair.

Track A acceptance criteria

• A real task-owned Git fixture supports whole-repository Trunk validation without changing shared Git metadata.
• The declared Go 1.26.6 runtime deterministically builds and runs Gitleaks 8.30.1.
• The repository runs its CI/config validator and Trunk gate on relevant pull requests and pushes.
• Renovate 44.30.1 validates the shared preset and repository consumer config without semantic changes.
• Retained starter workflows render and pass actionlint; orphan metadata is removed.
• Broken issue-form links are replaced with current organization-owned policy files.
• The unowned whole-repository Pages workflow is removed without changing Pages settings or deployments.
• Operational failures are separated from pre-existing lint debt.

Safety boundary

This issue does not authorize staging, source commits, push, pull request creation, merge, release, live workflow dispatch, settings mutation, hosted Renovate changes, Dependency Dashboard approval, cross-repository changes, or cleanup.

Related ownership

• chore(deps): migrate repositories to hybrid Renovate ownership #452
• Review proposed organization ADRs 0008–0010 for acceptance #454
• ops: rationalize scheduled workflows and recurring organization maintenance #485