build(readiness): pin scheduled evidence workflow actions and toolchain

[seonghobae]

Problem

The protected scheduled/manual saleable-readiness evidence workflow previously used mutable third-party Action tags, broad Node/npm semantics, persisted checkout credentials by default, plain npm ci, and warning-only artifact retention. That made retained buyer/operational evidence weaker than Noema's reviewed CI execution contract.

RCA / selected remedy

First failing boundary: trusted scheduled/manual readiness workflow -> executable setup/dependency installation -> retained readiness evidence.

The smallest root-cause-changing remedy was to pin the already-reviewed Action revisions, disable persisted checkout credentials, bind Node/npm to the exact reviewed identities, use frozen install flags, and make missing retained readiness artifacts fail closed. Replacing the workflow/service architecture was materially larger and unnecessary.

Test-first lineage and protected integration

Fresh protected-main successor PR #218 completed the repair after its predecessor line became stale.

• exact test-only RED: 3fccc27b192b67f6e45aaf15122db8e532347a20;
• exact GREEN head: 1bf9eb8036669939e9a8f0d759571c81ce5b685a;
• application ci 31581914055: terminal success on the unchanged GREEN head;
• reviewer-ci 31581913986: terminal success;
• eligible central Security Scan 31581914013: terminal success;
• formal reviews: 0 and inline review threads: 0 at final pre-merge read;
• live ruleset 18794436 required the central Security Scan workflow and contained no current pull-request approval rule, so no synthetic approval requirement was invented;
• PR fix(readiness): restack immutable evidence toolchain after commercial writer #218 merged without waiver as protected-main commit 8bb925abc6a14b4baf2491ef9d7fd958f1f1c38c.

Protected-main push acceptance on that exact merge commit also completed successfully for application ci (31586369663) and reviewer-ci (31586369669). Historical duplicate/superseded readiness PRs #217 and #146 were closed only after their two final workstream blobs were proven byte-identical to the integrated protected-main files.

Acceptance

• Test-first RED proved the mutable action/toolchain state.
• Checkout, setup-node and upload-artifact use immutable reviewed revisions.
• Checkout credentials are non-persistent.
• Readiness execution uses Node 24.19.0, verifies npm 11.17.0, and installs with npm ci --legacy-peer-deps=false --install-links=false.
• Existing scheduled report-only/manual behavior, KPI collection, readiness audit semantics and artifact paths remain unchanged.
• Missing retained readiness evidence fails closed.
• Exact-head application CI, reviewer-ci, eligible central Security Scan, reviews and threads were revalidated before protected merge.
• Protected-main application/reviewer acceptance passed after integration.
• No real production KPI, release, deployment, customer/revenue, owner/legal/IP-transfer, outbound-license, or acquisition-readiness claim was created by this hardening.

This issue is complete as a repository-owned workflow/toolchain hardening item. Real production KPI and broader acquisition evidence remain independently tracked under #3/#5 and related operational/legal lanes.

Related: #3, #5, #27, #77, #79, #146, #217, #218