fix(ci): retarget ci-pipeline pin to standards#989 squash SHA ed5e3f65

f95130bb predated hyperpolymath/standards#989 and carried both defects that PR
cures: the exemption-ledger checkout read `ref: a2ff696a` (an abbreviated SHA,
which `git fetch` cannot resolve) and `detect` did its own `exit 1`, so a
ledgered repository went red regardless of its exemption.

Re-pins to ed5e3f65 - the squash merge of #989 on standards' main - where the
ledger is read at `${{ job.workflow_sha }}` and `report` is the single judge.

Proven on the pilot before this wave: AcceleratorGate.jl#40, dispatch run
35770740241, printed `ledger read at
'ed5e3f651305dd1ce0d0b5d2d08b97a963634632'` - the callee's own commit, 40 hex,
non-empty - and the run was green while correctly refusing.

The provenance comment moves with the pin: a stale comment is a phantom pin.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR

Author: hyperpolymath

.github/workflows/standards-pipeline.yml

@@ -33,10 +33,10 @@ permissions:
 
 jobs:
   pipeline:
-    # hyperpolymath/standards @ f95130bb — ci-pipeline.yml blob 8bcdeaf2.
+    # hyperpolymath/standards @ ed5e3f65 — ci-pipeline.yml blob ea87c43a.
     #
     # NO `secrets:` block, deliberately. ci-pipeline.yml declares
     # `workflow_call.inputs` only, has no `secrets:` block and references no
     # `secrets.*` anywhere; `secrets: inherit` would hand the whole store to a
     # workflow that consumes none of it.
-    uses: hyperpolymath/standards/.github/workflows/ci-pipeline.yml@f95130bbcbc8917bfec8f8875fa810ad93b08871
+    uses: hyperpolymath/standards/.github/workflows/ci-pipeline.yml@ed5e3f651305dd1ce0d0b5d2d08b97a963634632