[robinbowes]

Stacked on #99 (base chore/deps-in-range). This repository now deletes merged branches, so GitHub will retarget this PR to main when #99 merges.

Summary

This lands #98 on main. #98 was merged into its stacked base ci/pin-actions rather than main, because that base wasn't deleted on merge. The workflow changes are #98's commit b6ec628, cherry-picked unchanged:

ci.yml           gate: timeout 15 · gitleaks: shell bash (pipefail), curl -f, sha256sum --check before tar
deploy.yml       timeouts 5/5/20/10/20 · staging, production: no `cache: pnpm` · release.tag_name via env
evals.yml        permissions: contents: read · ${SUITE:+"$SUITE"}
kit.yml          permissions: contents: read · timeouts 10/15/20 · unused `ids` output dropped · unfrozen rename install marked intended
notify-plugins   permissions: contents: read · timeout 5 · queued concurrency
plugin-ci.yml    timeouts 10 / 30

The only other changes are:

• The porting note: [ci] Harden the CI workflows #98's entries (steps 22–26) are appended to the full release note from [cli] Close the login callback connection on 404 #93–[web] Run the kit on Node 26 #97. [ci] Pin GitHub Actions to current majors by SHA #94's bullet now says the deploy jobs lose cache: pnpm, which the review gate flagged as contradicting the hardening entry.
• A merge of main: it changes no files, and means the branch isn't behind main.

Evidence

• jactionlint --online reports 0 findings, and actionlint is clean.
• pnpm gate passes on Node 26.13.0. Merging main leaves the tree identical to the gated one.
• [ci] Harden the CI workflows #98 itself was reviewed and green in CI.

Merge Danger

Door: two-way

Blast Radius: CI

The changes that can affect a run are the timeouts and the uncached deploy installs. Merge with a merge commit.

🤖 Generated with Claude Code