Triage: 3 pre-existing red checks surfaced by the actions.lock cure (PR #95)

[hyperpolymath]

Summary

hyperpolymath/vexometer#95 carries the actions.lock desync cure from the estate campaign (hyperpolymath/standards#968). The lockfile change itself verifies clean. The checks listed below are pre-existing reds that only became visible once the cure revived the workflows that run them.

Per the standing stopping rule, a pre-existing red is an issue with acceptance criteria, not a merge blocker. This is that issue for this repo.

Failing checks (3)

lint-workflows

Frequently appears twice (a matrix leg). Fix once; both legs clear together.

• Determine whether lint-workflows is fixed, retired, or accepted with a documented exemption. It may not stay undetermined.
• Record whether lint-workflows is also red on main. If it is, it measures the estate, not this change, and nothing is required of this branch that its base does not satisfy.
• If fixed: the check is green on this PR head, and the fix is in the repo — not continue-on-error, not a demotion to a warning, not removal from the required set.

lint-workflows

Frequently appears twice (a matrix leg). Fix once; both legs clear together.

• Determine whether lint-workflows is fixed, retired, or accepted with a documented exemption. It may not stay undetermined.
• Record whether lint-workflows is also red on main. If it is, it measures the estate, not this change, and nothing is required of this branch that its base does not satisfy.
• If fixed: the check is green on this PR head, and the fix is in the repo — not continue-on-error, not a demotion to a warning, not removal from the required set.

governance / Workflow security linter

Also red on main in several repos. Confirm whether this repo's main is red before treating it as a branch defect.

• Determine whether governance / Workflow security linter is fixed, retired, or accepted with a documented exemption. It may not stay undetermined.
• Record whether governance / Workflow security linter is also red on main. If it is, it measures the estate, not this change, and nothing is required of this branch that its base does not satisfy.
• If fixed: the check is green on this PR head, and the fix is in the repo — not continue-on-error, not a demotion to a warning, not removal from the required set.

Acceptance criteria for closing this issue

• Every check above has a recorded determination (fix / retire / exempt).
• Any check determined fixed is green on a run of this repo's default branch.
• Any check determined retired is removed from the workflow and from the repo's required-check set in the same change.
• Any check determined exempt has the exemption written down with its reason and a review date.
• No check was closed by muting it. Repair or retire; never silence.

Context

• Campaign roll-up: actions.lock step-level desync: 39 repos with silently dead CI (startup_failure) standards#968
• Cross-cutting classes (this repo's reds are mostly instances of them): Cross-cutting governance reds surfaced by the actions.lock cure — 9 classes across 17 PRs (incl. a live gate for the retired A2ML) standards#994
• Lock policy + the pin bump that disarms the latent blocker: actions.lock policy: job-level reusable refs are reported, never required — and the pin bump that disarms the latent blocker standards#993

🤖 Generated with Claude Code

https://claude.ai/code/session_01X3hgXxWm6umMgZkjYyHnnm

[hyperpolymath]

fix(ci): repair workflow security checks for issue #96

Restore SPDX headers and immutable action pins.
Upgrade governance to eliminate actions.lock false positives.
Synchronize lockfile dependencies and fix duplicate workflow YAML.
Add workflow security regression tests and document main failures.

Affected checks pass on the PR head without weakening enforcement.
Issue #96 closure requires successful post-merge checks on main.

Refs #96