Governance/Hypatia hygiene: stale GEMINI.md, unpinned action, workflow timeouts, shellcheck

[hyperpolymath]

Pre-existing Hypatia baseline findings (272 total; non-blocking — the Validate Hypatia baseline check passes) in boj-server. Mechanical cleanup, surfaced during the required-gate skip-shim work (#216) and deliberately left out of scope there.

Items

• Delete stale GEMINI.md (root_hygiene / stale) — leftover AI-session file.
• Pin the unpinned action in governance.yml to a commit SHA (estate action-pinning policy).
• missing_timeout_minutes — add timeout-minutes to jobs lacking it: abi-drift.yml (the verify job), codeql.yml, container-publish.yml, dogfood-gate.yml (6 jobs), and the heavy test job in zig-test.yml.
• Pre-existing shellcheck infos (from actionlint): abi-drift.yml (SC2046/SC2012/SC2086 in the emit/verify loop) and zig-test.yml (SC2012/SC2046 in the scope/test steps) — quote / find-ify as appropriate.

Done-when

• actionlint clean on the touched workflows.
• A fresh Hypatia scan no longer reports these items.

https://claude.ai/code/session_019tMcRS1Dm1nWjjYP4WvbJa

[hyperpolymath]

Status check against main today (2026-08-07) — 3 of 4 items are already done, and the fourth has shrunk to one dead file.

Item	Status	Evidence
Delete stale GEMINI.md	✅ done	ls GEMINI.md → absent
Pin the unpinned action in governance.yml	✅ done	grep -cE 'uses:.*@(v[0-9]|main|master)$' .github/workflows/governance.yml → 0
missing_timeout_minutes	✅ done	all five named workflows (abi-drift, codeql, container-publish, dogfood-gate, zig-test) report 0 jobs without timeout-minutes
Pre-existing shellcheck infos	⚠️ partial	zig-test.yml → 0 remaining (its scope loop was deleted outright by #305, which retired the per-cartridge build). abi-drift.yml → 2 $(ls …) constructs remain.

The one survivor is in a workflow that can never run. abi-drift.yml was hard-gated off (printf 'run=false') when the bundled cartridges/ tree was retired in #300 — its subject, per-cartridge iseriser drift, moved to boj-server-cartridges. Fixing SC2012 in a dead gate is not worth a PR; porting the gate to the registry and then deleting this workflow plus its required context is. That larger item is tracked as C-1 in the new DEBT.md (#306).

Recommend narrowing this issue to the abi-drift port, or closing it in favour of DEBT C-1 — your call. Leaving it open rather than closing on a 3-of-4.

While verifying, one thing worth knowing that touches the same area: .github/workflows/main-estate-audit.yml (untracked in both repos) references hyperpolymath/cicd-suite, which 404s on GitHub — though a local checkout holds all 26 referenced actions with action.ymls and 0 commits / no remote. It was written and never published, so the workflow is correct but unrunnable, and cannot be SHA-pinned until cicd-suite ships. Tracked as DEBT C-3.