chore(deps): update shared workflow pins

.github/workflows/ci.yml

@@ -33,7 +33,7 @@ jobs:
 
       - name: Enforce release intent
         # The repository owner publishes this versioned shared contract.
-        uses: stella/.github/.github/actions/changeset-policy@04c86bb54f4ae022354d72f8a40400bc7cf7428c
+        uses: stella/.github/.github/actions/changeset-policy@6a095097f5f9dc7e157ced38f978802d335baf08
         with:
           release-paths: ${{ steps.release-packages.outputs.release-paths }}
           generated-paths: ${{ steps.release-packages.outputs.generated-paths }}

.github/workflows/cla.yml

@@ -28,7 +28,7 @@ jobs:
           || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA'
         )
       )
-    uses: stella/.github/.github/workflows/cla.yml@04c86bb54f4ae022354d72f8a40400bc7cf7428c
+    uses: stella/.github/.github/workflows/cla.yml@6a095097f5f9dc7e157ced38f978802d335baf08
     with:
       allowlist: dependabot[bot],renovate[bot],github-actions[bot],stella-provenance-updater[bot],google-labs-jules[bot],cursoragent
     secrets:

.github/workflows/publish.yml

@@ -134,7 +134,7 @@ jobs:
       contents: write
       id-token: write
     # Keep this caller filename stable: npm trusted publishing authorizes it.
-    uses: stella/.github/.github/workflows/npm-independent-release.yml@04c86bb54f4ae022354d72f8a40400bc7cf7428c
+    uses: stella/.github/.github/workflows/npm-independent-release.yml@6a095097f5f9dc7e157ced38f978802d335baf08
     with:
       artifact-run-id: ${{ inputs.artifact_run_id || '' }}
       artifact-pattern: npm-tarball-*

.github/workflows/quarantine-policy.yml

@@ -15,4 +15,4 @@ jobs:
     if: github.repository == 'stella/tooling'
     permissions:
       contents: read
-    uses: stella/.github/.github/workflows/quarantine-policy.yml@04c86bb54f4ae022354d72f8a40400bc7cf7428c
+    uses: stella/.github/.github/workflows/quarantine-policy.yml@6a095097f5f9dc7e157ced38f978802d335baf08

.github/workflows/quarantine-prune.yml

@@ -13,7 +13,7 @@ jobs:
     if: github.repository == 'stella/tooling'
     permissions:
       contents: read
-    uses: stella/.github/.github/workflows/quarantine-prune.yml@04c86bb54f4ae022354d72f8a40400bc7cf7428c
+    uses: stella/.github/.github/workflows/quarantine-prune.yml@6a095097f5f9dc7e157ced38f978802d335baf08
     secrets:
       CHANGELOG_APP_ID: ${{ secrets.CHANGELOG_APP_ID }}
       CHANGELOG_APP_PRIVATE_KEY: ${{ secrets.CHANGELOG_APP_PRIVATE_KEY }}

.github/workflows/release-policy.yml

@@ -20,6 +20,6 @@ jobs:
     name: Enforce release boundaries
     permissions:
       contents: read
-    uses: stella/.github/.github/workflows/release-policy.yml@04c86bb54f4ae022354d72f8a40400bc7cf7428c
+    uses: stella/.github/.github/workflows/release-policy.yml@6a095097f5f9dc7e157ced38f978802d335baf08
     with:
       workflow: .github/workflows/publish.yml

.github/workflows/release-pr.yml

@@ -20,7 +20,7 @@ jobs:
       pull-requests: read
       checks: read
     # The repository owner publishes this versioned shared contract.
-    uses: stella/.github/.github/workflows/changeset-release-pr.yml@04c86bb54f4ae022354d72f8a40400bc7cf7428c
+    uses: stella/.github/.github/workflows/changeset-release-pr.yml@6a095097f5f9dc7e157ced38f978802d335baf08
     with:
       bun-version-file: package.json
     secrets:

scripts/rust-ci.test.ts

@@ -108,8 +108,10 @@ test("the required-check workflows handle merge groups and use the reviewed veri
   expect(cla["on"]["pull_request_target"]).toEqual({
     types: ["opened", "synchronize", "reopened", "ready_for_review"],
   });
-  expect(cla["jobs"]["cla"]["uses"]).toBe(
-    "stella/.github/.github/workflows/cla.yml@04c86bb54f4ae022354d72f8a40400bc7cf7428c",
+  // The pin itself belongs to Dependabot; the contract is the reviewed
+  // reusable workflow at an immutable commit.
+  expect(cla["jobs"]["cla"]["uses"]).toMatch(
+    /^stella\/\.github\/\.github\/workflows\/cla\.yml@[0-9a-f]{40}$/u,
   );
   expect(cla["jobs"]["cla"]["if"]).toContain(
     "github.event_name == 'merge_group'",