[ORESoftware]

Hardens existing CI without changing product behavior.

Changes in this first wave:

• pin FP-conformance actions and disable persisted checkout credentials
• use explicit Ubuntu runner labels instead of mutable latest
• add least-privilege permissions, concurrency and timeout policy to ores-lint
• serialize interface-fleet and one-shot runtime-env workflows
• scope role-contract write access to its branch-fixup job and authenticate the push explicitly

This is intentionally separate from #388 so control-plane outage logic can be reviewed independently from repository-policy debt. The repository hardening workflow should be treated as the acceptance test; do not merge around red exact-head checks.

[ORESoftware]

Continuation-batch scope check: keep this CI/provenance hardening independent from #388 outage behavior. Promotion should require the hardened workflow itself to execute on the exact head and prove pinned actions, credentialless checkout, least-privilege permissions, concurrency and timeout semantics. Do not use a source-fallback green run as substitute evidence for this repository-policy tranche.

[ORESoftware]

Superseded by current-main semantic successor #416. The five useful workflow-hardening deltas were replayed onto current main rather than merging this branch 13 commits behind, and #416 additionally repaired the Python 3.12 dynamic-module test harness exposed by fresh exact-head CI. Keeping the global FP/portability/candidate failures fail-closed on the successor; this stale carrier should not be merged.