fix(actions): validate composite dependencies under native runner locking

[hyperpolymath]

Fraying PR #65 passed gh actions-lock verification but GitHub rejected startup because the nested K9 SHA reference had no matching runtime lock entry. Align nested validator refs with the native locked references, and onboard the suite self-tests and estate audit to GitHub action locking. The same composite gate now exercises valid A2ML/K9 fixtures and deliberate failures with runtime lock enforcement active. Full authoritative lock verification passes for all four workflows. This follows #5 and preserves real validator failures.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 60d9c6c5-4998-4237-a5d2-a5ce93eb731b

📥 Commits

Reviewing files that changed from the base of the PR and between 5eb5ae8 and f2e4f8c.

⛔ Files ignored due to path filters (1)

• .github/workflows/actions.lock is excluded by !**/*.lock

📒 Files selected for processing (5)

• .github/workflows/code-hygiene-self-test.yml
• .github/workflows/label-triage.yml
• .github/workflows/labels.yml
• .github/workflows/main-estate-audit.yml
• actions/manifest-check/action.yml

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated workflow management metadata and action references.
  • Added a 10-minute limit to one automated validation workflow.
  • Updated checkout and validation action version references.
  • Standardised gate and manifest validation workflow references.

Walkthrough

The changes update workflow metadata and action references. They add a test timeout, replace local action paths, update checkout references, and change manifest validators to use their main branches.

Changes

Workflow maintenance

Layer / File(s)	Summary
Workflow reference and execution updates .github/workflows/*.yml	Workflows add gh actions-lock headers. The self-test adds a 10-minute timeout. Checkout references use v7.0.1, and local action paths use $/actions/....
Manifest validator references actions/manifest-check/action.yml	The validation steps use hyperpolymath/deed-ecosystem/validate-action@main and hyperpolymath/k9-ecosystem/validate-action@main. Existing inputs remain unchanged.

Estimated code review effort: 2 (Simple) | ~10 minutes

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{I hop through workflows, neat and bright
Tags now guide the actions right
Validators follow branches green
Ten minutes guard the testing scene
Squeak, the manifests pass clean}

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud