Add a fleet scanner for every Zed repository that consumes ORESoftware/typespec-json-schema-validator.
Acceptance:
- enumerate exact TJSV SHAs and reusable-action SHAs across the org;
- define minimum required capabilities (dense declaration inventory, current-input verification, canonical refusal probes, conditional-witness safety, receipt schema);
- fail CI when a repo pins an older revision that lacks required capabilities unless an explicit exception exists;
- machine-readable exception ledger with owner/reason/expiry;
- distinguish intentional immutable pins from accidental drift;
- emit Markdown/JSON evidence suitable for Linear/GitHub updates;
- scheduled run plus local deterministic command.
Linear parent/related: DEN-3982, DEN-3828.
Add a fleet scanner for every Zed repository that consumes
ORESoftware/typespec-json-schema-validator.Acceptance:
Linear parent/related: DEN-3982, DEN-3828.