chore(ci): SPDX headers on line 1 and Actions lockfile minted

.github/workflows/actions.lock

@@ -0,0 +1,125 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.2'
+workflows:
+    '.github/workflows/casket-pages.yml':
+        - 'actions/cache@v4.3.0'
+        - 'actions/checkout@v4.1.1'
+        - 'actions/configure-pages@v5.0.0'
+        - 'actions/deploy-pages@v4.0.5'
+        - 'actions/upload-pages-artifact@v3.0.1'
+        - 'haskell-actions/setup@v2.7.5'
+    '.github/workflows/codeql.yml':
+        - 'actions/checkout@v6.0.1'
+        - 'github/codeql-action@v4.31.10'
+    '.github/workflows/hypatia-scan.yml':
+        - 'actions/checkout@v4.1.1'
+        - 'actions/github-script@v7.0.1'
+        - 'actions/upload-artifact@v4.6.2'
+        - 'erlef/setup-beam@v1.17.5'
+    '.github/workflows/lean-build.yml':
+        - 'actions/cache@v4.2.3'
+        - 'actions/checkout@v4.1.1'
+        - 'actions/upload-artifact@v4.3.0'
+        - 'gaurav-nelson/github-action-markdown-link-check@1.0.15'
+        - 'mlugg/setup-zig@v2.2.1'
+    '.github/workflows/push-email-notify.yml':
+        - 'dawidd6/action-send-mail@v3.12.0'
+    '.github/workflows/scorecard.yml':
+        - 'actions/checkout@v6.0.1'
+        - 'actions/upload-artifact@v4.3.0'
+        - 'ossf/scorecard-action@v2.4.3'
+dependencies:
+    'actions/cache@v4.2.3':
+        ref: 'v4.2.3'
+        commit: 'sha1-5a3ec84eff668545956fd18022155c47e93e2684'
+        owner_id: 44036562
+        repo_id: 215566462
+    'actions/cache@v4.3.0':
+        ref: 'v4.3.0'
+        commit: 'sha1-0057852bfaa89a56745cba8c7296529d2fc39830'
+        owner_id: 44036562
+        repo_id: 215566462
+    'actions/checkout@v4.1.1':
+        ref: 'v4.1.1'
+        commit: 'sha1-b4ffde65f46336ab88eb53be808477a3936bae11'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/checkout@v6.0.1':
+        ref: 'v6.0.1'
+        commit: 'sha1-8e8c483db84b4bee98b60c0593521ed34d9990e8'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/configure-pages@v5.0.0':
+        ref: 'v5.0.0'
+        commit: 'sha1-983d7736d9b0ae728b81ab479565c72886d7745b'
+        owner_id: 44036562
+        repo_id: 513659658
+    'actions/deploy-pages@v4.0.5':
+        ref: 'v4.0.5'
+        commit: 'sha1-d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e'
+        owner_id: 44036562
+        repo_id: 438112499
+    'actions/github-script@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-60a0d83039c74a4aee543508d2ffcb1c3799cdea'
+        owner_id: 44036562
+        repo_id: 205262760
+    'actions/upload-artifact@v4':
+        ref: 'v4'
+        commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
+        owner_id: 44036562
+        repo_id: 192625955
+    'actions/upload-artifact@v4.3.0':
+        ref: 'v4.3.0'
+        commit: 'sha1-26f96dfa697d77e81fd5907df203aa23a56210a8'
+        owner_id: 44036562
+        repo_id: 192625955
+    'actions/upload-artifact@v4.6.2':
+        ref: 'v4.6.2'
+        commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
+        owner_id: 44036562
+        repo_id: 192625955
+    'actions/upload-pages-artifact@v3.0.1':
+        ref: 'v3.0.1'
+        commit: 'sha1-56afc609e74202658d3ffba0e8f6dda462b719fa'
+        owner_id: 44036562
+        repo_id: 496012378
+        uses:
+            - 'actions/upload-artifact@v4'
+    'dawidd6/action-send-mail@v3.12.0':
+        ref: 'v3.12.0'
+        commit: 'sha1-6e502825a508b867ab2954ad6343b68787624c01'
+        owner_id: 9713907
+        repo_id: 222439721
+    'erlef/setup-beam@v1.17.5':
+        ref: 'v1.17.5'
+        commit: 'sha1-2f0cc07b4b9bea248ae098aba9e1a8a1de5ec24c'
+        owner_id: 47606891
+        repo_id: 331103973
+    'gaurav-nelson/github-action-markdown-link-check@1.0.15':
+        ref: '1.0.15'
+        commit: 'sha1-d53a906aa6b22b8979d33bc86170567e619495ec'
+        owner_id: 23069445
+        repo_id: 178552370
+    'github/codeql-action@v4.31.10':
+        ref: 'v4.31.10'
+        commit: 'sha1-cdefb33c0f6224e58673d9004f47f7cb3e328b89'
+        owner_id: 9919
+        repo_id: 259445878
+    'haskell-actions/setup@v2.7.5':
+        ref: 'v2.7.5'
+        commit: 'sha1-ec49483bfc012387b227434aba94f59a6ecd0900'
+        owner_id: 75048950
+        repo_id: 623796603
+    'mlugg/setup-zig@v2.2.1':
+        ref: 'v2.2.1'
+        commit: 'sha1-d1434d08867e3ee9daa34448df10607b98908d29'
+        owner_id: 7289241
+        repo_id: 812112570
+    'ossf/scorecard-action@v2.4.3':
+        ref: 'v2.4.3'
+        commit: 'sha1-4eaacf0543bb3f2c246792bd56e8cdeffafb205a'
+        owner_id: 67707773
+        repo_id: 421101922

.github/workflows/casket-pages.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: GitHub Pages
 
 on:
@@ -20,22 +21,22 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+        uses: actions/checkout@v4.1.1
 
       - name: Checkout casket-ssg
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+        uses: actions/checkout@v4.1.1
         with:
           repository: hyperpolymath/casket-ssg
           path: .casket-ssg
 
       - name: Setup GHCup
-        uses: haskell-actions/setup@ec49483bfc012387b227434aba94f59a6ecd0900 # v2
+        uses: haskell-actions/setup@v2.7.5
         with:
           ghc-version: '9.8.2'
           cabal-version: '3.10'
 
       - name: Cache Cabal
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache@v4.3.0
         with:
           path: |
             ~/.cabal/packages
@@ -79,10 +80,10 @@ jobs:
           cd .casket-ssg && cabal run casket-ssg -- build ../site ../_site
 
       - name: Setup Pages
-        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
+        uses: actions/configure-pages@v5.0.0
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
+        uses: actions/upload-pages-artifact@v3.0.1
         with:
           path: '_site'
 
@@ -95,4 +96,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
+        uses: actions/deploy-pages@v4.0.5

.github/workflows/codeql.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: CodeQL Security Analysis
 
 on:
@@ -26,15 +27,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@v6.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v3.28.1
+        uses: github/codeql-action/init@v4.31.10
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v3.28.1
+        uses: github/codeql-action/analyze@v4.31.10
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/governance.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # governance.yml — single wrapper calling the shared estate governance bundle
 # in hyperpolymath/standards instead of carrying per-repo copies.
 #

.github/workflows/hypatia-scan.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Hypatia Neurosymbolic CI/CD Security Scan
 name: Hypatia Security Scan
 
@@ -20,12 +21,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+        uses: actions/checkout@v4.1.1
         with:
           fetch-depth: 0  # Full history for better pattern analysis
 
       - name: Setup Elixir for Hypatia scanner
-        uses: erlef/setup-beam@2f0cc07b4b9bea248ae098aba9e1a8a1de5ec24c # v1.18.2
+        uses: erlef/setup-beam@v1.17.5
         with:
           elixir-version: '1.19.4'
           otp-version: '28.3'
@@ -74,7 +75,7 @@ jobs:
           echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY
 
       - name: Upload findings artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: hypatia-findings
           path: hypatia-findings.json
@@ -145,7 +146,7 @@ jobs:
 
       - name: Comment on PR with findings
         if: github.event_name == 'pull_request' && steps.scan.outputs.findings_count > 0
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
+        uses: actions/github-script@v7.0.1
         with:
           script: |
             const fs = require('fs');

.github/workflows/lean-build.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Lean 4 Build and Test Workflow
 name: Lean 4 Build
 
@@ -18,7 +19,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+        uses: actions/checkout@v4.1.1
 
       - name: Install elan (Lean version manager)
         run: |
@@ -35,7 +36,7 @@ jobs:
       # That failure aborted this job BEFORE `lake build` ever ran, which is why
       # CI never once reported whether this project compiles.
       - name: Cache Lean dependencies
-        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        uses: actions/cache@v4.2.3
         with:
           path: |
             .lake
@@ -77,7 +78,7 @@ jobs:
 
       - name: Upload build log
         if: always()
-        uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4
+        uses: actions/upload-artifact@v4.3.0
         with:
           name: lake-build-log
           path: lake-build.log
@@ -89,13 +90,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+        uses: actions/checkout@v4.1.1
 
       # Was goto-bus-stop/setup-zig@2a9625d… — that SHA does not exist and the
       # action is unmaintained (it has no v2 tag at all), so this job could
       # never start. mlugg/setup-zig is the maintained successor.
       - name: Setup Zig
-        uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2
+        uses: mlugg/setup-zig@v2.2.1
         with:
           version: 0.16.0
 
@@ -125,7 +126,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+        uses: actions/checkout@v4.1.1
 
       - name: Check EBNF grammar syntax
         run: |
@@ -167,10 +168,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+        uses: actions/checkout@v4.1.1
 
       - name: Check markdown links
-        uses: gaurav-nelson/github-action-markdown-link-check@d53a906aa6b22b8979d33bc86170567e619495ec # v1
+        uses: gaurav-nelson/github-action-markdown-link-check@1.0.15
         with:
           use-quiet-mode: 'yes'
           config-file: '.github/markdown-link-check-config.json'
@@ -183,7 +184,7 @@ jobs:
           cat spec-index.txt
 
       - name: Upload spec index
-        uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4
+        uses: actions/upload-artifact@v4.3.0
         with:
           name: spec-index
           path: spec-index.txt

.github/workflows/push-email-notify.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Dormant push-email notification. ARMED by setting the repo variable
 # PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled;
 # sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by
@@ -15,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Send push notification email
-        uses: dawidd6/action-send-mail@6e502825a508b867ab2954ad6343b68787624c01 # pinned
+        uses: dawidd6/action-send-mail@v3.12.0
         with:
           server_address: ${{ secrets.SMTP_HOST }}
           server_port: ${{ secrets.SMTP_PORT }}

.github/workflows/scorecard.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: OSSF Scorecard
 on:
   schedule:
@@ -22,19 +23,19 @@ jobs:
     permissions:
       id-token: write
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@v6.0.1
         with:
           persist-credentials: false
 
       - name: Run Scorecard
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.3.1
+        uses: ossf/scorecard-action@v2.4.3
         with:
           results_file: results.sarif
           results_format: sarif
 
       # NOT github/codeql-action/upload-sarif — see the policy note above.
       - name: Upload results as artifact
-        uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4
+        uses: actions/upload-artifact@v4.3.0
         with:
           name: scorecard-results
           path: results.sarif

.github/workflows/secret-scanner.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Calls the estate's shared secret scanner (gitleaks + rust-secrets +
 # shell-secrets). Added because this repository had NO leak scanning at all.
 #