ci: bump the pr-issue-linkage pin to the four-section contract

[kyle-sexton]

No related issue: prerequisite pin bump. The drift check #58 specifies lands separately.

Summary

.github/workflows/pr-issue-linkage.yml pinned melodic-software/ci-workflows's
pr-issue-linkage reusable at e9443874 (v0.10.2). At that ref the gate enforces exactly two
things: a native closing keyword (or a no-issue marker) and a non-empty ## Related section.

The four-section contract — ## Summary, ## Fix, ## Verification, ## Related — landed
upstream in ci-workflows#153, between v0.12.0 and v0.14.0, which is after this pin. So
.github/PULL_REQUEST_TEMPLATE.md and
.claude/source-control.md have both been declaring three sections
that nothing actually gated on this repository's pull requests. The two local declarations were
not mirrors of an enforced contract; they were ahead of it.

This repository was one of two callers out of nine in the organization still short of that
contract (the other, codex-plugins, is bumped in melodic-software/codex-plugins#25).

Fix

Move the pin to 7107b34832a7b6db5d08d3b132621c599fbe5e50 (v0.14.2) and update the workflow's
header comment to describe the contract that ref actually enforces.

• Why v0.14.2. It is the ref six sibling repositories already run
  (claude-code-plugins, dotfiles, github-iac, medley, provisioning, standards), and
  the reusable's workflow file is byte-identical from v0.14.2 through ci-workflows' main, so
  v0.14.0-and-later is one contract rather than several. Standards' runner-policy records an
  approvedReusableWorkflowContracts entry for this exact path-and-SHA.
• Why the job now grants permissions. The reusable at this ref declares
  pull-requests: read (to read the PR body it validates) and actions: read (for its
  cancelled-versus-timed_out prerequisite resolver); v0.10.2 declared neither. A reusable cannot
  elevate caller permissions, and GitHub rejects it at startup when the caller grants a stricter
  set — leaving permissions: {} would mean the required check context never materializes at
  all, rather than reporting red. Standards' runner-policy records the same pair as this ref's
  minimumCallerPermissions, so this is a floor and not a surplus grant.
• No select-runner job added. This repository vendors no runner-policy component and
  ci.yml has no selector-conformance lane; every lane runs on hosted runners. The reusable's
  runner input defaults to ubuntu-24.04, so the thin caller shape is preserved.
• No exempt-authors added. It is optional at this ref and defaults to exempting no one.
  Adding a bypass is a separate policy decision — see Related for the pre-existing condition it
  would address.

Behavior change this lands, on purpose

Once merged, ## Summary, ## Fix, and ## Verification become gating on this repository's
pull requests, matching what both local declarations already say and what six sibling repos
already enforce.

Because the gate runs on pull_request_target, it evaluates the base-branch definition. So
open pull requests that lack the three sections go red on their next synchronize, edited, or
reopened event after this merges, without any change of their own. The queue is empty right now
(zero open PRs), so nothing is affected today. melodic-standards-sync[bot] already writes all
four sections, verified against #100, so the recurring sync PRs stay green.

This pull request itself is validated by the v0.10.2 definition on main, not the one it
introduces.

Verification

• Resolved the tag to a full SHA rather than trusting the short form:
  gh api repos/melodic-software/ci-workflows/git/ref/tags/v0.14.2 returns
  7107b34832a7b6db5d08d3b132621c599fbe5e50, type: commit (a lightweight tag, so no
  dereference step), committed 2026-08-13.
• Read the reusable's workflow_call contract at that exact SHA. Inputs are runner
  (default ubuntu-24.04), prerequisite-result (default success), and exempt-authors
  (default "") — all optional, so a caller passing no with: block is valid. Its top-level
  permissions block is pull-requests: read + actions: read.
• Confirmed standards' components/runner-policy/policy.json carries
  approvedReusableWorkflowContracts["melodic-software/ci-workflows/.github/workflows/pr-issue-linkage.yml@7107b34832a7b6db5d08d3b132621c599fbe5e50"]
  with allowedInputs: ["runner", "prerequisite-result", "exempt-authors"] and
  minimumCallerPermissions: {pull-requests: read, actions: read}. The same SHA is also in
  approvedSelectorReferencesByRepositoryOwner, but that array governs select-runner.yml only.
• Confirmed standards' repin-policy-lockstep.mjs operates on standards-owned caller files
  (components/claude-lanes/*, its own .github/workflows/claude-review.yml) for the
  claude-review / claude-security-review / standards-sync reusables. It does not sweep this
  repository, and does not cover pr-issue-linkage.
• Confirmed .github/PULL_REQUEST_TEMPLATE.md already carries all four ## headings and
  .claude/source-control.md already lists all four under pr_body_required_sections, so no
  local declaration needs to change alongside the bump.
• actionlint .github/workflows/pr-issue-linkage.yml — clean.
• typos --config _typos.toml .github/workflows/pr-issue-linkage.yml — clean.
• Diffed the caller against dotfiles and provisioning, both already on 7107b348, to confirm
  the permissions pair is what those callers grant.

Related

• Refs chore: make the two local PR-section declarations checkable against the fixed upstream contract #58 — this bump is the prerequisite that issue's escalation comment identified
  ("Prerequisite (separate reviewed PR)... Then chore: make the two local PR-section declarations checkable against the fixed upstream contract #58 executes mechanically"). chore: make the two local PR-section declarations checkable against the fixed upstream contract #58's own acceptance
  criteria are a local drift check comparing both mirrors against the pinned reusable, which this
  pull request deliberately does not implement; chore: make the two local PR-section declarations checkable against the fixed upstream contract #58 stays open and is now unblocked.
• Refs pr-issue-linkage: decide enforcement scope for remaining PR body sections (Summary/Fix/Verification) ci-workflows#153 — the upstream change that introduced the four-section
  requiredSections array.
• Refs ci: bump the pr-issue-linkage pin to the four-section contract codex-plugins#25 — the same bump for the other stale caller, taking that
  repository from v0.9.1 to v0.14.2.
• Pre-existing, untouched here: Dependabot pull requests already fail pr-issue-linkage at the
  current pin (verified on build: bump actions/checkout from 7.0.0 to 7.0.1 in the github-actions group #37, which failed the check and was merged anyway). provisioning and
  dotfiles set exempt-authors: 'dependabot[bot],melodic-standards-sync[bot]'; this repository
  sets nothing. The bump neither creates nor worsens that, so fixing it belongs in its own change.