Hypatia RE001: adopt step-security/harden-runner estate-wide, or record WONTFIX (23 instances)

[hyperpolymath]

Research rule RE001 wants step-security/harden-runner on every job touching secrets.*. The estate uses harden-runner NOWHERE (23 instances). Decision needed: adopt estate-wide, or record a principled WONTFIX (egress monitoring via other means).

Acknowledged in .hypatia-baseline.json (hypatia triage 2026-09-22, expires 2026-12-22) by the main-red fix-forward. This issue is the tracking item; closing it requires either remediating the instances or renewing the acknowledgement.

Instances (23):

• research_extensions/RE001 warn — .github/workflows/allowlist-preflight-reusable.yml
  job in .github/workflows/allowlist-preflight-reusable.yml references secrets.* but does not install step-security/harden-runner — review outbound-egress monitoring
• research_extensions/RE001 warn — .github/workflows/apply-workflow-pins.yml
  job in .github/workflows/apply-workflow-pins.yml references secrets.* but does not install step-security/harden-runner — review outbound-egress monitoring
• research_extensions/RE001 warn — .github/workflows/boj-build.yml
  job in .github/workflows/boj-build.yml references secrets.* but does not install step-security/harden-runner — review outbound-egress monitoring
• research_extensions/RE001 warn — .github/workflows/github-backup-mirror-reusable.yml
  job in .github/workflows/github-backup-mirror-reusable.yml references secrets.* but does not install step-security/harden-runner — review outbound-egress monitoring
• research_extensions/RE001 warn — .github/workflows/governance-reusable.yml
  job in .github/workflows/governance-reusable.yml references secrets.* but does not install step-security/harden-runner — review outbound-egress monitoring
• research_extensions/RE001 warn — .github/workflows/hypatia-scan-reusable.yml
  job in .github/workflows/hypatia-scan-reusable.yml references secrets.* but does not install step-security/harden-runner — review outbound-egress monitoring
• research_extensions/RE001 warn — .github/workflows/instant-sync.yml
  job in .github/workflows/instant-sync.yml references secrets.* but does not install step-security/harden-runner — review outbound-egress monitoring
• research_extensions/RE001 warn — .github/workflows/label-triage.yml
  job in .github/workflows/label-triage.yml references secrets.* but does not install step-security/harden-runner — review outbound-egress monitoring
• research_extensions/RE001 warn — .github/workflows/labels.yml
  job in .github/workflows/labels.yml references secrets.* but does not install step-security/harden-runner — review outbound-egress monitoring
• research_extensions/RE001 warn — .github/workflows/lockfile-drift-detect.yml
  job in .github/workflows/lockfile-drift-detect.yml references secrets.* but does not install step-security/harden-runner — review outbound-egress monitoring
• research_extensions/RE001 warn — .github/workflows/mirror-reusable.yml
  job in .github/workflows/mirror-reusable.yml references secrets.* but does not install step-security/harden-runner — review outbound-egress monitoring
• research_extensions/RE001 warn — .github/workflows/mirror-reusable.yml
  job in .github/workflows/mirror-reusable.yml references secrets.* but does not install step-security/harden-runner — review outbound-egress monitoring
• research_extensions/RE001 warn — .github/workflows/mirror-reusable.yml
  job in .github/workflows/mirror-reusable.yml references secrets.* but does not install step-security/harden-runner — review outbound-egress monitoring
• research_extensions/RE001 warn — .github/workflows/mirror-reusable.yml
  job in .github/workflows/mirror-reusable.yml references secrets.* but does not install step-security/harden-runner — review outbound-egress monitoring
• research_extensions/RE001 warn — .github/workflows/mirror-reusable.yml
  job in .github/workflows/mirror-reusable.yml references secrets.* but does not install step-security/harden-runner — review outbound-egress monitoring
• research_extensions/RE001 warn — .github/workflows/mirror-reusable.yml
  job in .github/workflows/mirror-reusable.yml references secrets.* but does not install step-security/harden-runner — review outbound-egress monitoring
• research_extensions/RE001 warn — .github/workflows/mirror-reusable.yml
  job in .github/workflows/mirror-reusable.yml references secrets.* but does not install step-security/harden-runner — review outbound-egress monitoring
• research_extensions/RE001 warn — .github/workflows/propagate-hooks.yml
  job in .github/workflows/propagate-hooks.yml references secrets.* but does not install step-security/harden-runner — review outbound-egress monitoring
• research_extensions/RE001 warn — .github/workflows/propagate-hooks.yml
  job in .github/workflows/propagate-hooks.yml references secrets.* but does not install step-security/harden-runner — review outbound-egress monitoring
• research_extensions/RE001 warn — .github/workflows/settings-drift-detect.yml
  job in .github/workflows/settings-drift-detect.yml references secrets.* but does not install step-security/harden-runner — review outbound-egress monitoring
• research_extensions/RE001 warn — .github/workflows/signed-push-smoke.yml
  job in .github/workflows/signed-push-smoke.yml references secrets.* but does not install step-security/harden-runner — review outbound-egress monitoring
• research_extensions/RE001 warn — .github/workflows/tag-ruleset-canon.yml
  job in .github/workflows/tag-ruleset-canon.yml references secrets.* but does not install step-security/harden-runner — review outbound-egress monitoring
• research_extensions/RE001 warn — .github/workflows/tailscale-connect-reusable.yml
  job in .github/workflows/tailscale-connect-reusable.yml references secrets.* but does not install step-security/harden-runner — review outbound-egress monitoring