fix(ci): repair governance failures tracked in #207

[arena-ai-coding-agent]

Summary

Addresses #207 (deliberately not auto-closing: default-branch green runs are required).

• Confirmed both named checks fail on main at 5b3a1fd, run 36444014532.
• Both are determined fix, not retire/exempt: Hypatia references a Standards commit not reachable from main.
• Repin Hypatia to the published Standards revision already used by governance; preserve blocking behavior.
• Reconcile the lock including transitive dependencies and existing CodeQL desynchronization.
• Record evidence and closure requirements in docs/handoff/issue-207-governance-triage.adoc.

Validation

• Canonical upstream pin resolver: PASS (8 unique pins).
• Exact pinned staleness checker: PASS.
• git diff --check: PASS.
• Full lock checks pending CI: GNU awk unavailable locally and package/release downloads failed. Lock reconciliation was manual.

No checks muted and no required-check settings changed. Keep #207 open until both named checks pass on this PR and then main.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 09791bf2-64f4-4dc5-bc3c-f3649824daf8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}