[dev]: audit reusable-workflow pins that are not on main #775

Your feedback for the existing codebase

Nothing stops a repository from pinning an organization reusable workflow to a commit that is not on this repository's main. In #774, twelve callers pinned commit-lint.yml to 64a427d, the pre-squash commit of #764; after the merge it was on no branch, and every Commit Lint run in those repositories ended in a startup failure with no jobs, so the required Policy checks never reported. The CI guidance requires full-SHA pins but does not say the SHA must be on main, and no audit checks it.

Acceptance criteria:

• automation/governance/repo-settings-audit.rb gains --workflow-pins: for each repository it reads the top-level workflow files on the default branch, finds every z-shell/.github/.github/workflows/NAME@SHA pin, and reports a pin whose SHA the compare API does not place on main (identical or behind) as off_main, or as missing when the commit is not found; --fail-on-drift exits 1 on either. Tests cover extraction, both drift states, nested paths and the CLI.
• The daily Community Health Audit runs with --workflow-pins.
• The CI workflow contract says an organization reusable workflow is pinned only to a commit on main, and how to check it.

Contact Details

Not applicable: filed by a maintainer.