fix(ci): drop temp probe triggers; final lock shape (exact 9-pin standards closure)

Probe runs on this branch established the real root cause of the mass
startup_failure: the triggering actor. GitHub's error annotation on the
startup_failed runs reads 'Actor is not allowed to trigger Actions
workflows' — arena-ai-coding-agent[bot] (which authored/merged PRs #93
and #94 and files issues) is not permitted to trigger Actions anywhere
in the org (same signature on rsr-template-repo's 2026-09-24 PR runs).
Dependabot- and owner-actor runs on the same commits succeed.

The file-side defects this PR fixes are real but narrower: the
nonexistent governance pin (28f7a2cb), the pre-#684/#686 governance
pin, and the actions.lock drift. The 9-pin standards closure is the
exact union of the five called reusables' step-level actions at
da2c748a (verified against the standards tree at that commit; the
template's 11-pin list covers rust-ci-reusable, which this repo does
not call).

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>

Author: hyperpolymath

.github/workflows/governance.yml

@@ -4,7 +4,7 @@ name: Governance
 
 on:
   push:
-    branches: [main, master, arena/01a0df21-wordpress-tools]
+    branches: [main, master]
   pull_request:
     branches: [main, master]
   workflow_dispatch:

.github/workflows/hypatia-scan.yml

@@ -4,7 +4,7 @@ name: Hypatia Security Scan
 
 on:
   push:
-    branches: [main, master, develop, arena/01a0df21-wordpress-tools]
+    branches: [main, master, develop]
   pull_request:
     branches: [main, master]
   schedule: