ci: make governed estimation checks reproducible

[tom-sapletta-com]

Ticket: ticket-009

Unblocks functional PR #1 without weakening governance.

Changes

• configure Windows LF handling before checkout
• activate managed hooks in Linux and Windows jobs
• pin external actions by full commit SHA
• avoid destructive worktree reset

Validation

• full package suite: 8 passed
• governance: 0 errors, 0 warnings
• delete_branch_on_merge is enabled

After this prerequisite merges, ticket-008 will be rebuilt plan-first on current main.

[ifuri-validator-agent]

Deterministic Validator approval for exact head e5c0eb612908780c9dd2b4a102e885d945a797c3.

Ticket: ticket-009
Correlation ID: estimation-pr-2-ticket-009
Model: zai/glm-5.3
Reviewed diff chunks: 1
Advisory LLM verdict: APPROVE
Advisory summary: Reviewed all 1 diff chunk(s). CI workflow changes pin actions by full commit SHA, configure LF handling before Windows checkout, and activate managed git hooks in both jobs. Supporting ticket-009 governance artifacts are consistent with the changes. All checks pass.
Advisory findings: none
The LLM output above is advisory and was not used as the approval trust root.
Merge will be attempted after this approval when explicitly authorized.

Decision record (recomputable)

DECISION D-009-0546
TICKET ticket-009
HEAD_SHA e5c0eb612908780c9dd2b4a102e885d945a797c3
CORRELATION_ID estimation-pr-2-ticket-009
ACTOR agent:ifuri-validator-agent[bot]
APPLIED_RULE P-CORE-015
INPUT author_login = "tom-sapletta-com"
INPUT observed_checks = ["governance / remote lifecycle=PASS","test=PASS","windows-governance=PASS","governance / enforce=PASS"]
INPUT required_checks = ["test","windows-governance"]
INPUT required_checks_source = "protected registry (governance/required-checks.json)"
INPUT reviewer_login = "ifuri-validator-agent[bot]"
VERDICT APPROVE AUTHORITY DETERMINISTIC
REJECTED REQUEST_CHANGES BECAUSE NO_UNSAFE_CHANGE_REASON_FOUND
ADVISORY llm_verdict = "APPROVE" MODEL "zai/glm-5.3"
ASSERT VERDICT_AUTHORITY != "ADVISORY"