Triage zizmor 1.26.1 adhoc-packages findings (pinned to 1.25.2 to unblock CI)

[artyhoo]

Context

The Install zizmor step in .github/workflows/audit-self.yml was unpinned (pip install zizmor) → CI silently jumped 1.25.2 → 1.26.1 (between 2026-06-20 and 2026-06-22). 1.26.1 tightened the adhoc-packages audit, surfacing 5 pre-existing LOW findings in our own self-CI workflows. Since ci-success needs: zizmor, this red-ed every fresh PR with no code cause (first hit: recovery PR #653).

Mitigation already shipped: pinned to zizmor==1.25.2 (last known-green) in #653 — audit-self.yml:735. This issue tracks the deferred triage of the 1.26.1 findings (the fix only froze the tool; it did not address the findings).

The 5 findings (zizmor 1.26.1, rule adhoc-packages, all LOW)

File	Line	Step
.github/workflows/audit-self.yml	165	npm install --prefix packages/core --silent
.github/workflows/audit-self.yml	206	npm install --prefix packages/core --silent
.github/workflows/audit-self.yml	446	npm install --prefix "$GITHUB_WORKSPACE/packages/core" --silent
.github/workflows/audit-self.yml	476	npm install --prefix "$GITHUB_WORKSPACE/packages/core" --silent
.github/workflows/framework-self-template-render.yml	35	ad-hoc install step

(zizmor reported 36 findings, 31 auto-suppressed by its default persona; these 5 LOW are the remainder 1.26.1 newly enforces. All in self-CI workflows — not shipped consumer supply-chain.)

Decision needed (enforcement-posture call, maintainer)

1. Suppress-config — add .github/zizmor.yml with ignore[adhoc-packages] for these workflows, then un-pin zizmor (back to latest). Keeps the tool current; explicitly accepts the rule as N/A for self-CI.
2. Fix the findings — restructure/pin the ad-hoc installs so the audit passes clean on latest. Stricter, more work, risk of touching working CI steps.
3. Keep pinned — stay on 1.25.2 deliberately; freezes the tool until a manual bump.

Acceptance

• zizmor either un-pinned with findings resolved/suppressed, OR pin documented as a deliberate, owned decision — AND ci-success stays green.

Surfaced during #644/#647 work; root cause was the unpinned pip install zizmor (a CI supply-chain tool installed without a version pin — ironic for zizmor itself).

[artyhoo]

Resolved by #663 (merged to staging, squash f2627d2) — option 2 (fix):

• The 5 adhoc-packages findings fixed via npm install --prefix → npm ci --prefix; zizmor un-pinned to 1.26.1 and the audit passes clean (verified green in CI).
• Root cause internalised: new Class-A rule .claude/rules/ci-tool-pinning.md + earliest-channel pre-push gate unpinned-tool-install.ts catching the bare-run: unpinned tool installs that zizmor's adhoc-packages does not (SSOT docs: close decision 0.2 — companion = C (both, layered) #153).

Correction to this issue's table: rows for lines 446/476 originally labelled git init --quiet — that was a mislabel; zizmor flagged the npm install --prefix steps on those lines (git init is a separate, non-flagged step at ~450/480). The table above is corrected; all 5 findings were the same npm install --prefix pattern.