ci(pipeline): re-pin ci-pipeline.yml to f95130bb

This caller was pinned to 2eb9bb19, which predates metadatastician/standards#985.
That commit fixed the ci-pipeline detect gate; every caller still on 2eb9bb19
runs the pre-fix gate and goes red on its next pull_request.

Re-pins to f95130bb (the #985 squash merge) and updates the provenance comment
to the matching blob 8bcdeaf2. Both lines move together: a SHA bump that leaves
a stale blob comment behind is a phantom pin, unverifiable against the tree it
claims to name.

f95130bb was chosen over current main (d1bd7f42) deliberately: ci-pipeline.yml
is byte-identical at both (blob 8bcdeaf2), f95130bb is the reviewed revision,
and its only red checks are SonarCloud and the mirror trio -- all four listed
in standards' own config/rulesets/gates.json never_required_workflows.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR

Author: hyperpolymath

.github/workflows/standards-pipeline.yml

@@ -33,10 +33,10 @@ permissions:
 
 jobs:
   pipeline:
-    # hyperpolymath/standards @ 2eb9bb19 — ci-pipeline.yml blob d2583657.
+    # hyperpolymath/standards @ f95130bb — ci-pipeline.yml blob 8bcdeaf2.
     #
     # NO `secrets:` block, deliberately. ci-pipeline.yml declares
     # `workflow_call.inputs` only, has no `secrets:` block and references no
     # `secrets.*` anywhere; `secrets: inherit` would hand the whole store to a
     # workflow that consumes none of it.
-    uses: hyperpolymath/standards/.github/workflows/ci-pipeline.yml@2eb9bb19d43b6285466ca36b92d1324a09e7a207
+    uses: hyperpolymath/standards/.github/workflows/ci-pipeline.yml@f95130bbcbc8917bfec8f8875fa810ad93b08871