N20: Pin checker, policy and offline verifier for containment smoke

[avoroncov971-maker]

Allowlist

• .github/workflows/proof-check-pinned.yml

Merged at head 7a22493b7b66116990d4bbbd2dda0800a7e3acac as commit 363aad91142a01df6e5d72a87495d2f09be28823.

This version pins checker, policy, and offline verifier to accepted commit ea1536eda18fc59a36c3b08edaa93b2ecee111dd and was proven through remote consumption. It still uses the pull_request trigger and checks out the subject. The later trusted-base change was pushed after this PR had merged and is therefore not part of this merge.

Follow-up PR required: change the trigger to pull_request_target and remove the subject checkout before using this status as an enforcement gate.

[avoroncov971-maker]

@claude Please perform a READ_ONLY_ANALYSIS review of PR #8 at exact head ec64142 against accepted main ea1536e.

Review the single allowlisted workflow. Verify that pull_request_target takes the workflow from the trusted base, no PR-controlled bytes are executed or installed, all permissions are read-only, checker/policy/verifier are pinned to accepted full SHA, FAIL and INDETERMINATE remain failing conclusions, and artifacts remain available. Consider fork PR behavior and status-check enforcement.

Do not edit, push, approve, mark Ready, merge, release, or change settings. Return PASS, BLOCKED, or INDETERMINATE bound to this head with any blocking finding tied to a concrete failure mechanism.

[avoroncov971-maker]

CORRECTION: PR #8 merged before commit ec64142 was pushed. The @claude request above is not bound to this merged PR and must not be treated as its review. A separate follow-up PR will carry the trusted-base trigger change.