[gaborbernat]

Fixes the findings from the 2026-10-24 audit of 3.1.1 and trims the interface to what the 29 consumers use. The fragments in changelog.d/ list every change; this is the summary.

Security:

• Every prek call uses --config .pre-commit-config.yaml. The hook guards reject prek.toml, .pre-commit-config.yml and nested configs, which prek would otherwise run without any check.
• verify-frozen-hooks proves revision age before it builds hook repositories. The new check-tagged-source action checks main ancestry before running prek on a tag.
• Lock group names must be normalized, so project_runtime can no longer skip cooling.
• refresh-mise-pin checks the 7-day digest before mise runs.
• Marketplace retries ignore fork runs and carry the receipt forward.

Correctness:

• The weekly uv resolver upgrade can publish again.
• Human PRs can add cooled managed hook pins.
• Lock producer errors fail the step.
• The recheck accepts revisions observed on earlier heads.
• Workflow-only PRs run the lock check.

Breaking changes (4.0.0):

• The nab primary-lock path is removed: lock-groups is gone, and primary locks come only from release-creator locks.
• Removed inputs: upgrade-resolver, render-release-notes.output, validate-release-patch.patch.
• verify-nab-cutoff-patch is renamed to verify-cutoff-patch.
• validate-python-release callers must grant actions: read and pull-requests: read. 3.0.1 already required this; the CHANGELOG now records it as breaking.

Performance: nab is installed only for a refresh or a secondary lock, and the shared lock is not checked again on every install.

tox passes at 100% coverage, now measured over tests/ as well as tools/.