v1.0.0 — first pinnable release of the shared CI

First release of the estate's shared CI: the reusable GitHub Actions workflows in .github/workflows/ and the shared Lefthook hook config in lefthook/.

Why this exists

These definitions are consumed by 30 repos across the estate — 33 reusable-workflow references plus the shared Lefthook hooks in 4 repos. Until now every consumer pointed at @main, so a commit here changed 30 repos' CI the instant it merged: no pull request anywhere, no record of which repo ran which version, and no way to decline a change at an inconvenient moment. Every third-party action in the estate is pinned by commit SHA precisely to avoid that; our own shared CI was the exception.

v1.0.0 is the first state a consumer can pin to.

Tag policy

Released tags here are immutable and are never moved, and there is deliberately no floating v1. A broken shared workflow is remedied by a superseding patch release — moving a tag would silently change every consumer that already pinned, which is the exact failure this model removes.

What's in it

• ggshield-scan.yml — pre-merge GitGuardian secret scan (the estate's most widely consumed gate)
• kustomize-validate.yml — kustomize render + kubeconform schema validation for GitOps content repos
• komodo-deploy.yml — HMAC-signed Komodo stack deploy trigger, fired after an image push succeeds
• mirror-image.yml — mirror a badly-peered upstream image into a registry you control
• lefthook/base.yml — shared advisory pre-commit and pre-push hooks

No behaviour changed in this release; it names the current state so consumers can stop floating.

Part of the release + publish cycle map — spec in #38.