Align tool pins, revive dead Renovate managers, verify installer checksums #442

Severity: Medium (dead Renovate manager hides stale pins; two installers run unverified binaries) · Landing order: 5 of 10 · Blocked by: #441

Task is 3.51.1 across 18 workflow inputs plus mise.toml, govulncheck is inline at Taskfile.yml:199, and renovate.json:40-46 matches a gitleaks URL ci.yaml does not contain; nothing matches Makefile:184 or .custom-gcl.yml:6. hack/install-git-cliff.sh:39 and install-helm-docs.sh verify no checksum. Outcome: Task 3.52.0 everywhere, one GOVULNCHECK_VERSION, working Renovate managers with a liveness check, drift test on agreement plus floor, and checksum-verified installers.

Spec: openspec/changes/developer-toolchain-pins/ — requirements DTP-1..7; proposed in #437.

Tasks (one PR; red test first — see tasks.md):

• 1. Drift guard first: floors, agreement, empty-scan, manager liveness, mutants (1.1)
• 2. Pins: Task at every site, GOVULNCHECK_VERSION variable, mise.toml comment fix (2.1-2.3)
• 3. Renovate managers: probe, fix dead gitleaks manager, add Makefile/.custom-gcl.yml/pre-commit/installer managers (3.1-3.2)
• 4. Checksums for git-cliff and helm-docs installers via hack/lib/fetch.sh; tamper tests (4.1-4.2)
• 5. Archive as last commit after review and green CI (5.1)

Done when: every Verification row in tasks.md is pass (or post-merge with its follow-up issue linked), the independent review is recorded, and the change is archived.

Source: spec/oss-quality-signals @ 1745b60b (independent review + cold adversarial review, 2026-10-05).