TRU-342: Document the split pin policy

[jtcrde]

README refresh: documents the two consumption conventions (floating @v1 for validation workflows, exact pins for workflows that receive secrets) and trims the README to what external readers need — workflow catalogue, consumption examples, versioning. Internal context (tickets, rationale, review history) lives in the tracker, not here.

[zhianchow]

Approving — the workflow table and consumption examples check out against the files at v1.4.0.

Verified

• All eight listed workflows exist in the repo.
• Adding terraform-docs to the terraform-module-validation.yaml row is accurate — it installs terraform-docs 0.16.0 with a sha256sum -c check (as it does for tfsec 1.28.14).
• semantic-release.yaml does have the optional release_artifact input and the semver output described.
• The @v1.4.0 in the example matches what the migrated consumers pin, and v1 exists and currently resolves to the same commit as v1.4.0 (1229f4e).

Non-blocking

1. "Version tags are protected against modification" sits awkwardly next to a floating v1. The ruleset covers refs/tags/v* for creation/update/deletion with admin bypass — so v1 is modified on every minor/patch, deliberately, by an admin. Half a sentence distinguishing immutable vX.Y.Z from the intentionally-moving v1 would stop a reader concluding the floating tag can't be re-pointed.
2. Dropping the "Security posture" section is your call, and the tracker is the right home for review history. But "no secrets, so fork-triggered runs are safe" is the load-bearing justification for letting validation float on @v1, and it now survives only as a parenthetical in the Consumption list. Worth keeping as a sentence — it's the reasoning a future reader needs to evaluate the split.

[zhianchow]

Re-approving after 683a22fc. Both notes from my earlier review are resolved, and resolved accurately:

• The Versioning section now distinguishes immutable vX.Y.Z from a v1 that is deliberately re-pointed each release, and correctly attributes both to the tag ruleset with admin-only movement. That matches what the ruleset actually does (refs/tags/v*, create/update/delete, repo-admin bypass).
• The fork-safety rationale is back where it does the most good — inline in the Consumption bullet, as the reason a floating pin is acceptable for validation workflows rather than as a separate posture section a reader has to connect themselves.