shell-e2e-reusable.yml has the repo's only 2 unpinned refs (owner's staged work: report only)

[hyperpolymath]

Finding — report only, do not edit this file

.github/workflows/shell-e2e-reusable.yml carries the only two unpinned refs in
standards — verified at HEAD, 2026-09-22:

61:        uses: actions/checkout@v7.0.1
73:        uses: mlugg/setup-zig@v2.2.1

They are the actions-lock gate's only error-severity findings in this repo.

⚠ This file is the owner's staged, uncommitted work (git status shows it
staged). It was deliberately left untouched. This issue reports it; it does not
propose that anyone else edit it.

Consequence worth knowing before it surprises someone

Once validate-sha-pins.sh is per-ref rather than per-file (shipped in #899), the
pre-commit hook will refuse this file until its two refs are pinned. That is
correct behaviour, but it will look like a new breakage to whoever next commits it.

Note this also explains a measurement that flip-flopped: the lock gate reads rc=1 in
the dirty working tree and rc=0 / valid=true in a clean clone at HEAD,
because these two staged refs exist only in the tree. A dirty worktree is not the repo.

Source: developer/.claude/checkpoints/2026-09-22-cicd-pipeline-delivery.md §5-4.

Acceptance criteria

• The owner pins both refs to 40-hex SHAs when landing their staged work
• After that, the lock gate is rc=0 in both a clean clone and the working tree

Decision sheet: #787