ci: pin the standards reusable workflows to #1209's merge (2e12b312)

#73 restored block YAML so the actions-lock gate can read the pins, but it
merged with the pins still at 900c42c7. At that SHA the gate step runs under
`bash -e`, so the gate's exit 3 (missing-lock debt) kills the step before
`rc=$?` is read, and the ledger that excuses jaffascript never runs.
`governance / Actions lockfile verify` is red on main (809e521) for that
reason.

metadatastician/standards#1209 (merge 2e12b312, on standards main) reads the
exit code with `|| rc=$?`. Between 900c42c7 and 2e12b312 only
governance-reusable.yml changed among the four callees; the mirror,
scorecard and secret-scanner reusables are byte-identical, so all four
pins move together and the mirror.yml contract comment is updated to match.
The workflows stay in block YAML (see #73).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GpUzjdhWFi26k6s7AWxYcf

Author: hyperpolymath

.github/workflows/governance.yml

@@ -18,4 +18,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@900c42c70b968e11a2bca04bf0ce050be5c286dc
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@2e12b312b529c51f095ce3b22cd35968f5aba898

.github/workflows/mirror.yml

@@ -17,10 +17,10 @@ permissions:
 
 jobs:
   mirror:
-    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@900c42c70b968e11a2bca04bf0ce050be5c286dc
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@2e12b312b529c51f095ce3b22cd35968f5aba898
     # Each forge job is still gated on vars.<FORGE>_MIRROR_ENABLED, inside the
     # callee. Explicit secrets map, no secrets: inherit; these seven are the
-    # callee's complete optional contract at 900c42c70b968e11a2bca04bf0ce050be5c286dc.
+    # callee's complete optional contract at 2e12b312b529c51f095ce3b22cd35968f5aba898.
     secrets:
       GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }}
       BITBUCKET_SSH_KEY: ${{ secrets.BITBUCKET_SSH_KEY }}

.github/workflows/scorecard.yml

@@ -11,7 +11,7 @@ permissions:
 
 jobs:
   analysis:
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@900c42c70b968e11a2bca04bf0ce050be5c286dc
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@2e12b312b529c51f095ce3b22cd35968f5aba898
     # A job-level map replaces the workflow-level one, so every scope the
     # callee's jobs request must be listed here. actions: read is new in the
     # callee since 81dbf2dd. No secrets: the callee declares and reads none.

.github/workflows/secret-scanner.yml

@@ -24,4 +24,4 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@900c42c70b968e11a2bca04bf0ce050be5c286dc
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@2e12b312b529c51f095ce3b22cd35968f5aba898