governance-reusable.yml still has 7 'ref: main' helper checkouts reached by 368 pinned callers

[hyperpolymath]

Finding

governance-reusable.yml still carries 7 ref: main checkouts — verified at
HEAD, 2026-09-22, at exactly these lines:

254  674  975  1313  1344  1374  1419

Each is a helper checkout that follows a moving branch. This reusable is consumed
by 368 callers, all SHA-pinned — so a caller pinned to a reviewed SHA still
executes whatever main holds at run time for these seven fetches. The pin does not
mean what a reader expects it to mean.

Source: developer/.claude/checkpoints/2026-09-22-cicd-pipeline-delivery.md §5-11.

Acceptance criteria

• All 7 replaced with literal 40-hex SHAs, bumped in the same PR that changes them
• The contract test's ref: [0-9a-f]{40} assertion covers all seven sites,
  not just the one already covered
• Each SHA verified to be a commit before use (git cat-file -t) — a blob
  hash that looks like a commit is the phantom-pin trap
• bash scripts/tests/governance-reusable-contract-test.sh green

Decision sheet: #787