build(deps): land the 19 updates #494 queued behind one frozen head

.claude/settings.json

@@ -130,7 +130,10 @@
     ],
     "allow": [
       "$defaults",
-      "Allow every `batten` subcommand. It is this repository's own binary, built from the checkout in the working directory, and is the project's primary tool — refusing it blocks essentially all work here. Its checking verbs are declared read-only: they read repository state, git refs and a record store under $GIT_DIR, and emit pointers (a count, a path:line, a boolean), never file contents. Exit codes are a fixed contract: 0 clean, 1 usage/config error, 2 policy denial, 3 internal failure."
+      "Allow every `batten` subcommand. It is this repository's own binary, built from the checkout in the working directory, and is the project's primary tool — refusing it blocks essentially all work here. Its checking verbs are declared read-only: they read repository state, git refs and a record store under $GIT_DIR, and emit pointers (a count, a path:line, a boolean), never file contents. Exit codes are a fixed contract: 0 clean, 1 usage/config error, 2 policy denial, 3 internal failure.",
+      "Allow `git` — including `commit`, `push`, `fetch`, `rebase` and `push --force-with-lease` on a branch other than `main`. This repository lands by fast-forward, so a branch is rebased and force-pushed as ordinary routine rather than as recovery: `mise run land` rebases every lap, and each lap mints new SHAs that must reach the remote. Committing is local and reversible, and the pre-commit gate runs the whole hk check set before a commit is created, so a refused gate stops the commit rather than the commit escaping the gate. What must NOT be inferred from this grant: nothing here authorises a force-push to `main`, a history rewrite on a branch someone else holds, or a tag deletion. `main` is protected at the forge and advances only by fast-forward to a SHA whose required checks already concluded green.",
+      "Allow the Serena MCP tools — `read_memory`, `write_memory`, `edit_memory`, `rename_memory`, `list_memories`, and the symbol and search verbs — whatever server prefix the host exposes them under. Serena is this repository's declared instrument for two jobs the generic tools do worse: navigating code by symbol, and reading and writing `.serena/memories/**`, which `batten.toml` marks protected precisely so that writes go through these tools rather than by hand. Refusing them leaves the memory graph editable only by the route the repository's own gate denies.",
+      "Allow every `mise` command, including `mise run <task>`. mise is this repository's task runner and toolchain manager — AGENTS.md requires every tool, environment variable and command to go through it so that CI, the git hooks and a developer shell run byte-identical commands. Refusing it blocks essentially all work here, exactly as refusing `batten` would: the lint, format, test, verify and landing paths are all `mise run` tasks, and `mise.toml` plus `mise-tasks/` are committed to this repository and reviewed like any other code."
     ]
   }
 }

.github/workflows/auto-bot-land.yml

@@ -262,7 +262,7 @@ jobs:
         if: steps.target.outputs.num != ''
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
         if: steps.target.outputs.num != ''
       # THE LANE NEEDS THE ENGINE NOW, AND NOTHING WAS PROVIDING IT (CLOUD-1143's
       # consequence). `checks-green` was retired onto the engine, so `mise.toml`'s

.github/workflows/auto-release-land.yml

@@ -209,7 +209,7 @@ jobs:
         if: steps.target.outputs.num != ''
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
         if: steps.target.outputs.num != ''
       # THE LANE NEEDS THE ENGINE NOW, AND NOTHING WAS PROVIDING IT (CLOUD-1143's
       # consequence). `checks-green` was retired onto the engine, so `mise.toml`'s

.github/workflows/branch-hygiene.yml

@@ -43,7 +43,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
         with:
           # `gh` for both readings, `jq` for the GraphQL projection. Narrow, for
           # the reason ci.yml states: the whole toolchain is ~10s a job that

.github/workflows/ci-drift.yml

@@ -46,7 +46,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
       - run: mise run ci-drift
         env:
           # The rules API is a repository read; the job token carries it.

.github/workflows/ci.yml

@@ -201,7 +201,7 @@ jobs:
           if [ "$BASE_REF" != main ]; then
             git fetch origin "$BASE_REF:refs/remotes/origin/$BASE_REF"
           fi
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
         with:
           # Install only what this job's gates actually invoke, not the whole
           # 18-tool dev set. Every job used to install everything, and `zig`
@@ -505,7 +505,7 @@ jobs:
           fetch-depth: 0
       - name: Fetch the comparison base refs
         run: git fetch origin main:refs/remotes/origin/main
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
         with:
           # One line, for the reason the `ci` job's list states: `ci-tools-check`
           # parses these as a scalar and several names begin with `aqua:`, which
@@ -621,7 +621,7 @@ jobs:
           # merge base, and an unresolvable base is exit 2 by design rather than
           # a pass, so this would fail loudly rather than measure nothing.
           fetch-depth: 0
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
         with:
           # rust builds the two binaries under measurement, hyperfine samples
           # them, jq reads the ratio out. See the ci job for why these lists are

.github/workflows/commit-lint.yml

@@ -93,7 +93,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
         with:
           # `rust`, and nothing else. `commit-lint` depends on `commit-check` and
           # `commit-attribution`, both of which are `cargo run --quiet -p batten`,

.github/workflows/coverage.yml

@@ -55,7 +55,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
         with:
           # cargo-llvm-cov drives cargo; rust supplies the compiler and the
           # rustup that fetches llvm-tools-preview. Nothing else is invoked.

.github/workflows/fuzz.yml

@@ -65,7 +65,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
         with:
           # `rust` alone: it supplies cargo and the rustup that `mise run fuzz`
           # uses to fetch the nightly libFuzzer's `-Z sanitizer` requires, and

.github/workflows/hook-latency-drift.yml

@@ -53,7 +53,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
       - name: Report a fast tier that no longer matches its budget
         shell: bash
         run: mise run hook-latency-drift

.github/workflows/land-divergence.yml

@@ -55,7 +55,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
       # Measure to a FILE, then read it back — never `measure | assert`. A
       # pipeline hands the step's exit status to its last stage, so a measurement
       # that died would be judged as a clean empty window rather than reported

.github/workflows/linear-release-backfill.yml

@@ -149,14 +149,14 @@ jobs:
       # `github_token` is deliberately not passed — the action defaults it to
       # `${{ github.token }}`, which the job's `contents: read` covers.
       - name: Record the release in Linear
-        uses: linear/linear-release-action@17b8c24f8ceb2b98cabaf1965ff83c55dd596fac # v0.15.1
+        uses: linear/linear-release-action@0a25abab892a91062ebf42260dbb2ce6277aa205 # v0.16.0
         with:
           access_key: ${{ secrets.LINEAR_ACCESS_KEY }}
           command: sync
           version: ${{ inputs.tag }}
           base_ref: ${{ steps.base.outputs.ref }}
       - name: Complete the Linear release
-        uses: linear/linear-release-action@17b8c24f8ceb2b98cabaf1965ff83c55dd596fac # v0.15.1
+        uses: linear/linear-release-action@0a25abab892a91062ebf42260dbb2ce6277aa205 # v0.16.0
         with:
           access_key: ${{ secrets.LINEAR_ACCESS_KEY }}
           command: complete

.github/workflows/lock-currency.yml

@@ -45,7 +45,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
       # The lockfile rewrite this performs is fine here and only here: the
       # checkout is disposable, and no commit is being judged by it.
       - run: mise run lock-check

.github/workflows/mutant.yml

@@ -90,7 +90,7 @@ jobs:
           # committed bytes, so it needs the work tree rather than history — and
           # it writes nothing, so no credential is persisted.
           persist-credentials: false
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
       # THE PAIR IS THE VERDICT, never either alone. `mutant` asks whether each
       # declared mutation is caught; `mutant-census` asks whether every gate in
       # the tree is declared or carries a filed exemption. A change that dropped a

.github/workflows/nonverdict-rate.yml

@@ -60,7 +60,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
       # Measure to a FILE, then read it back — never `scan | assert`. A pipeline
       # hands the step's exit status to its last stage, so a scan that died would
       # be judged as an empty window rather than reported (perf.yml:84-92).

.github/workflows/perf.yml

@@ -88,7 +88,7 @@ jobs:
       # and a missing ref is the empty series rather than a failure.
       - name: Fetch the existing series
         run: git fetch origin "refs/notes/perf:refs/notes/perf" || true
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
         with:
           # rust builds the binary under measurement, hyperfine samples it, jq
           # reads the sampler's JSON back out. Nothing else is invoked.

.github/workflows/release-artifacts.yml

@@ -125,7 +125,7 @@ jobs:
       # flags cache-poisoning as high severity precisely on artifact-publishing
       # workflows: a poisoned cache entry would end up inside a signed binary,
       # and the attestation would faithfully attest to the compromised build.
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
         with:
           cache: false
       - name: Install cross
@@ -263,7 +263,7 @@ jobs:
         with:
           ref: ${{ inputs.tag || github.event.release.tag_name }}
           persist-credentials: false
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
         with:
           cache: false
       - name: Derive both schemas from the tagged config types
@@ -337,7 +337,7 @@ jobs:
         with:
           ref: ${{ inputs.tag || github.event.release.tag_name }}
           persist-credentials: false
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
         with:
           cache: false
       # `checksums` emits a sums= KEY=VALUE line, so the asset path is decided in

.github/workflows/release-assets.yml

@@ -51,7 +51,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
       # TAG goes through env, never interpolated into the run block: a `${{ }}`
       # expansion is textual substitution into the shell script, so a tag naming
       # shell metacharacters would execute. Same posture as every other run block

.github/workflows/release-plz.yml

@@ -152,7 +152,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
         with:
           # Exactly what the `ci` job needs to compile the workspace, minus the
           # tools only its assertions use: the cache being filled is a cargo
@@ -185,7 +185,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
         with:
           # Exactly what the `windows` job installs, minus the tools only its
           # assertions need: the cache being filled is a cargo target dir.
@@ -248,7 +248,7 @@ jobs:
         with:
           fetch-depth: 0
           token: ${{ secrets.RELEASE_PLZ_TOKEN || secrets.GITHUB_TOKEN }}
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
       # release-plz clones the repo into a temp dir; `git fetch origin main` there
       # has no credentials (actions/checkout's auth lives only on the main clone),
       # so it cannot rebase the release branch onto main — the PR is then re-opened
@@ -338,14 +338,14 @@ jobs:
       # silently shipping an untracked release.
       - name: Record the release in Linear
         if: steps.release-tag.outputs.tag != ''
-        uses: linear/linear-release-action@17b8c24f8ceb2b98cabaf1965ff83c55dd596fac # v0.15.1
+        uses: linear/linear-release-action@0a25abab892a91062ebf42260dbb2ce6277aa205 # v0.16.0
         with:
           access_key: ${{ secrets.LINEAR_ACCESS_KEY }}
           command: sync
           version: ${{ steps.release-tag.outputs.tag }}
       - name: Complete the Linear release
         if: steps.release-tag.outputs.tag != ''
-        uses: linear/linear-release-action@17b8c24f8ceb2b98cabaf1965ff83c55dd596fac # v0.15.1
+        uses: linear/linear-release-action@0a25abab892a91062ebf42260dbb2ce6277aa205 # v0.16.0
         with:
           access_key: ${{ secrets.LINEAR_ACCESS_KEY }}
           command: complete