SLSA / self-verifying-ref pin-exemption registry (remove harmful SHA mapping)

[hyperpolymath]

Refs #260 (do not auto-close).

Defect: workflow_audit.ex:49 and security_errors.ex:291 map slsa-framework/slsa-github-generator@v2.1.0 → <sha>. Applying the only symbolic remediation (SHA-pin) BREAKS SLSA provenance — the generator self-verifies github.ref and requires a semver tag. No exception channel exists, so modshells #63 stays open forever.

Fix:

• Remove the harmful SHA mapping for slsa-framework/slsa-github-generator.
• Introduce a first-class pin_exempt / must_track_tag registry (versioned data, not code constants) for reusable workflows that self-verify their ref.
• For exempt refs emit an accept finding with rationale, never a fix; reconciler dismisses the Scorecard alert with that rationale.

[hyperpolymath]

Jointly closed by explicit maintainer agreement (2026-05-17). Landed via PR #264: SecurityErrors.@pin_exempt data-driven registry; harmful slsa-github-generator SHA mapping removed; check_unpinned_actions emits :pin_exempt_accepted (accept-with-rationale, never a harmful pin). Refs #260.