Wire cross-repo reusable-workflow pin propagation (FUTURE-WORK #16)

[hyperpolymath]

Summary

The standards-side of reusable-pin freshness landed in #397 (ADR-003: the staleness gate tolerates a recency window, and scripts/propagate-workflow-pins.sh performs an audit-first bump). This issue tracks the remaining cross-repo wiring so a deliberate bump fans out automatically.

Remaining work (lives in other repos)

• hypatia — activate lib/rules/sha_bump_propagation.ex so a "consumer pin is behind standards HEAD" finding is routed (:review), not inert.
• gitbot-fleet — run propagate-workflow-pins.sh --fix in the flagged consumer and open a draft bump PR (mirror the .git-private-farm dispatch pattern in instant-sync.yml; gate on a PAT, graceful-skip without it).
• (optional) standards — a scheduled propagate-workflow-pins.yml that audits the fleet and dispatches the above. Sketch only; do not ship cross-repo dispatch without the PAT + owner sign-off (estate "no unattended mutations" guardrail).

Refs

• docs/decisions/ADR-003-workflow-pin-staleness-window.adoc
• docs/FUTURE-WORK.adoc item chore(deps): bump the actions group across 1 directory with 2 updates #16
• scripts/propagate-workflow-pins.sh

Priority

Low / convenience. The gate no longer forces bumps (consumers are green within the window), so this is a freshness improvement, not a treadmill fix.

[hyperpolymath]

2026-08-25 — standards side landed; the cross-repo half is the blocker, and it now has context

scripts/propagate-workflow-pins.sh exists with its test. There is no propagate-workflow-pins.yml workflow on origin/main.

The script's own header explains why that gap is deliberate: "NEVER commits or pushes — that is the human's / bot's job (estate guardrail: no unattended mutations)."

Measured consequence of the gap: 1,152 pinned references to standards reusables across the estate span 25 distinct SHA generations, and current HEAD d67def67 appears zero times. Most-used pin is 5b1d0022 at 510 references.

This is #633 child 3. It is blocked on child 1 — without a merge path, propagated PRs simply queue.

Verified 2026-08-25 against live GitHub, not local checkouts.

[hyperpolymath]

Closing as superseded by #633 — per the ruled decision docket

All three checkboxes here are built (verified live 2026-08-27): hypatia lib/rules/sha_bump_propagation.ex (@strategy :review, in the catalogue, appearing in verisimdb-data/scans/hypatia.json) · gitbot-fleet scripts/propagate-sha-bump.sh + smoke test · .git-private-farm/.github/workflows/sha-bump-propagate.yml.

And yet the loop has fired once, ever — 2026-06-21, by workflow_dispatch, conclusion failure; never once by repository_dispatch, the trigger it exists for. Consistent with standards HEAD appearing 0× in 1,152 pins.

So the defect is not "build the pieces" (done) — it is "the wiring between them never fires", which is precisely #633 child 1. Keeping this open would track completed checkboxes while the real fault lives elsewhere. The only genuinely absent item (the optional standards-side scheduler, bullet 3) is noted on #633.