[ORESoftware]

Semantic current-main successor to #416, rebuilt from main@bbd24936796bb19231299f69a19cf4152f8da5db after #415 advanced the base and made the prior carrier non-mergeable.

This replays only the six reviewed hardening changes from #416:

• pin FP-conformance checkout/setup/upload actions, disable persisted credentials, and use Ubuntu 24.04;
• add concurrency and fixed Ubuntu runners to interface-fleet audit;
• serialize the one-shot runtime-env patch workflow;
• harden ores-lint with read-only permissions, concurrency, timeout, pinned actions, and no persisted credentials;
• scope role-contract write permission to the branch-fixup job and authenticate its explicit push with gh auth setup-git;
• register the dynamically loaded fleet-audit Python module in sys.modules before execution.

No product source, manifest, Cargo lockfile, generated contract, release metadata, or FP budget was replayed. Exact-head executed failures remain blockers; genuinely runnerless/zero-step Actions caused by unavailable build minutes may be treated as unavailable evidence per the current merge policy.