[IanHollow]

Summary

- shared workflow pins at v2.9.0
+ shared workflow pins at verified v2.10.0
+ bounded recovery for transient Scorecard GraphQL outages

Use the published immutable shared-CI release for safe pin-only Dependabot queue admission and merge-group CodeQL handling. Keep required validation and independently reviewed release-builder and repository-checks pins. Recovery reruns only the current default-branch Scorecard run with a recognized transient service failure, at most twice.

Evidence

• Before: recent Scorecard runs failed on GitHub 504 errors and required manual reruns; both audited reruns succeeded.
• After: shared recovery regressions and required CI passed in nix-forge/ci PR77; release v2.10.0 completed unattended and its downloaded archive checksum and signed provenance verify. Framework PR95 passed native PR and queue checks with this release, and its default-branch queue reconciler installed the hash-locked parser successfully.
• This repository's required hosted PR and merge-group checks validate its integration before merging.

Merge Danger

Door: two-way

Revert the workflow pin and recovery wrapper to restore previous behavior.

Blast Radius: CI

No runtime or deployment configuration changes.