[ORESoftware]

Semantic current-main successor to #401.

This replays only the five still-useful workflow-hardening deltas onto current main rather than merging the stale branch that was 13 commits behind:

• pin FP-conformance checkout/setup/upload actions and disable persisted credentials;
• replace mutable ubuntu-latest with ubuntu-24.04 in the touched workflows;
• add least-privilege contents: read, concurrency, and timeout policy to ores-lint;
• serialize interface-fleet and one-shot runtime-env workflows;
• scope contents: write to the role-contract branch-fixup job and authenticate its push explicitly with gh auth setup-git while keeping checkout credentials disabled.

No product source, manifest, package graph, lockfile, release metadata, or FP budget is changed. Exact-head substantive CI remains the merge gate. Once this successor is accepted, #401 is superseded and can close without merging stale history.

[ORESoftware]

Exact-head refresh after reconciliation to current main: head c2a2fd3c89d1470b1ed70be3a5ea959673a4fd40 is structurally mergeable and the workflow-hardening-specific lanes are executing. fp-conformance is a real stepful failure, not a GHA-minutes/runner-admission refusal: the scan ran on Ubuntu 24.04 and reported repository-wide budget drift (for example RS003 1523 -> 1712). Zed latest dependency gate is also red and must be classified separately. Do not merge this PR under the steps=null exception while these executed failures remain. The PR itself still changes only the six workflow/test files; no FP budget rebaseline is included.

[ORESoftware]

Superseded by #421. main advanced to bbd24936796bb19231299f69a19cf4152f8da5db via #415 and this carrier became non-mergeable. I replayed only the six reviewed hardening changes onto that exact main tip; no product source, manifest, lockfile, generated contract, release metadata, or FP budget was carried forward. Closing this stale carrier avoids resolving conflicts by reintroducing old ancestry.