ci: pin supply-chain inputs and restrict workflow tokens

[mikemcdougall]

Mutable workflow actions and dependency installs allow CI inputs to change without review. Pin every external action to an immutable SHA with its version, install third-party Python dependencies from hash-checked locks, and install commit-bound editable packages without resolving additional dependencies. Keep the existing scanner behavior in local, pinned security jobs and scope write tokens to the jobs that publish results or releases.

Keep separate base and GeoPandas locks so grpc-only matrix lanes still exercise absence of optional dependencies. The fresh-wheel smoke test resolves the built wheels' declared dependencies offline from a hash-verified wheelhouse, then hash-checks that resolved set during installation; the full CI environment is not preinstalled. Update the publication lock to patched protobuf 6.33.5. Local smoke jobs use a pinned server image and verify that its source revision matches the checked-out seed scripts.

Validation: native Windows actionlint 1.7.12, honua-release action-pin checker, and git diff --check pass. Universal dependency locks cover Python 3.11+ and the CI OS matrix. Full PR CI is required at the final head.

Live baseline: 90 code-scanning alerts (80 PinnedDependenciesID, 5 TokenPermissionsID, 5 other policy/informational findings), 0 Dependabot. Scorecard counts must be checked again on trunk after merge. Release-asset upload and release-please jobs retain the write permissions their API operations require; no alerts have been dismissed.

External CI blocker: staging-smoke reports Client-compat binding is stale: expiresAt has passed. The governed staging binding needs renewal outside this workflow-only packet. Evidence: https://github.com/honua-io/honua-sdk-python/actions/runs/33947016244/job/101254849560 . The pinned local GP smoke passes.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-05T04:38:51.020069Z	87b0c13	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 87b0c13d78

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[mikemcdougall]

usage: lane=prod3 packet=10-sdkpython-adj-223-16f24c3.md input=1039818 cached=972800 output=6663 wall=6m