fix(ci): resync actions.lock, restore codeql hold, retire dead CI jobs with a written determination (#67)

[arena-ai-coding-agent]

Closes #67.

What #67 asked, and the answers

Check	Determination	Red on main too?
core-fill-tests	Retired	Yes — since #43 (2026-08-24) deleted deno.json, a month before #66. Its task was cargo test … fill_blocks_, a strict subset of the rust-core job.
extension-build	Retired	Yes — same #43 deletion; the bundle toolchain is not in the checkout at all. Comes back under a new name when the frontend has a pipeline.

Neither was in a required-check set (the repo's rulesets have no required_status_checks rule). Nothing was muted: no continue-on-error, no demotion, and the full ledger with a review date is in docs/ci/CHECK-DETERMINATIONS.adoc.

The larger thing underneath it

At main = d50a857, all nine push-triggered workflows were startup_failure, jobs=0 — including the Lock Sync Gate and the CI workflow that would run any check at all. Four consecutive merges after #66 rewrote uses: refs without touching actions.lock:

• chore(deps): bump the actions group with 3 updates #69 (Dependabot) bumped codeql-action to 1c5b675 (= v4.38.1, the held version) → killed codeql.yml, hypatia-scan.yml. It got through the hold because the ignore was github/codeql-action, which does not match the /init, /analyze, /upload-sarif subpath names Dependabot tracks. Merged with the gate red.
• chore(deps): bump haskell-actions/setup from 2.12.0 to 2.12.1 in the actions group #70 (Dependabot) bumped haskell-actions/setup → killed casket-pages.yml. Merged with the gate red.
• Fix CI and clarify project build status #71 replaced the ci.yml jobs, leaving stale setup-deno/wasm-pack-action lock entries → killed ci.yml. By then the gate was already dead from chore(deps): bump the actions group with 3 updates #69/chore(deps): bump haskell-actions/setup from 2.12.0 to 2.12.1 in the actions group #70, so nothing could flag it.

Changes

• actions.lock resynchronised and transitively closed — scripts/check-lock-sync.sh exits 0 on all four clauses.
• codeql.yml / hypatia-scan.yml: re-pinned to b96794f (true v4.38.0), restoring the hold fix(ci): codeql-action v4.38.1 -> v4.38.0 SHA pin + dependabot hold (estate-wide startup_failure) #64 set and ci: re-pin codeql-action to the true v4.38.0 commit #68 re-asserted. The # v4.38.0 comment Dependabot left next to the 4.38.1 SHA was false; it is now true.
• dependabot.yml: ignore glob github/codeql-action* (estate-canonical form from hyperpolymath/standards), weekly cadence, open-pull-requests-limit: 2, header explaining the lock contract.
• ci.yml: rust-core kept; the duplicate workflow-lock job dropped — it ran inside a workflow GitHub refuses to start on exactly the fault it checked, so it could never report. lock-sync-gate.yml (no uses:) is the authoritative gate.
• docs/ci/CHECK-DETERMINATIONS.adoc: the ledger, root-cause table, standing rules, review date 2026-12-27.
• TEST-NEEDS.adoc, TOPOLOGY.adoc, CHANGELOG.adoc: stop describing a Deno/Jest pipeline that does not exist.

Verification

• scripts/check-lock-sync.sh → actions.lock is in sync and transitively closed (run locally with gawk).
• All workflow YAML parses.
• rust-core has never had a run that reached execution (every prior ci.yml run was a Deno failure or a startup failure), and this sandbox cannot reach crates.io, so this PR's checks are the first real run. If rust-core is red here, that is a genuine finding about the crate and I will fix it in this PR rather than merge over it.

Owner action that this PR cannot do (needs admin)

Add actions.lock is in sync with the workflow YAML and Rust core (tests, formatting, lint) as required status checks on main. #69 and #70 were merged by hand with the gate red; without a required-check rule the standing rule "never merge over a red gate" is a convention, not an enforcement. This is the piece that makes the fix permanent.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 6a965bc3-4984-445d-96db-b9287c8681fd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}