docs(ci): handle CodeQL unpinned-tag alerts on @main callers (#809)

[ss-o]

Summary

• Workflow contract (source knowledge/domains/ci/workflow-contract.md and generated .github/instructions/ci/workflow-contract.instructions.md): a new Action Pinning rule says that CodeQL's actions/unpinned-tag query reports @main references to organization reusable workflows. When a caller moves, the alert arrives as a review thread that blocks merge, and it is handled by replying with the ADR-0042 reason, dismissing it as "won't fix" and resolving the thread. Only alerts on z-shell/.github/.github/workflows/*@main are dismissed; any other actions/unpinned-tag alert stays a defect to fix. The pre-merge checklist gains the matching item.
• ADR-0042: one Consequences bullet records this effect and points to the contract. The decision, status and acceptance are unchanged.
• The documented dismissal was chosen over a CodeQL filter because 57 of the organization's 94 unarchived repositories run CodeQL default setup on Actions, and default setup cannot filter queries; a filter would mean moving all of them to advanced setup.

Closes #809

Impact review

1. Classification: shared CI policy (the workflow contract) plus a factual consequence on an accepted decision; no enforcement or runtime behavior changes.
2. Consumers: every repository with workflows; the change-impact report lists 16 declared consumer repositories for review. They read the contract through their routing block's links to main, so nothing is regenerated or repinned downstream.
3. Owner: unchanged; the contract source stays the editable owner and ADR-0042 stays the decision record.
4. Duplication or contradiction: none. The ADR bullet points to the contract for the procedure instead of repeating it.
5. Manifests: no route changes.
6. Runtime delivery: unchanged; the generated instruction is delivered by the existing pipeline.
7. Generation and size: knowledge-delivery.py --check passes for 57 consumers.

Verification

• knowledge-delivery.py --check, knowledge-coverage.py, decision-records.py --check, validate-agent-policy.py, org-routing.py validate, org-routing.py verify-approved and validate-zsh-standard-policy.py pass.
• 339 unit tests pass: knowledge coverage 7, delivery 14, decision records 17, agent policy 99, routing and policy report 91, Zsh standard policy 111.
• git diff --check and trunk check --no-fix --ci on the three files pass.
• The procedure matches what resolved code-scanning alert 16 in zsh-lint PR 699.

Agent handoff

No handoff needed.

[ss-o]

Fallback review under ADR-0026: maintainer elected after the Copilot request did not register, on fd7313b

Findings

No actionable findings in the three-file diff against main.

Checklist verdicts

• Scope: pass. The contract gains one Action Pinning rule and one checklist item; the generated instruction matches its source (knowledge-delivery.py --check). ADR-0042 gains one Consequences bullet; its decision, status, deciders and acceptance are unchanged.
• Accuracy: pass. The rule matches what happened in zsh-lint PR 699: CodeQL actions/unpinned-tag (code-scanning alert 16) arrived as a review thread on the @main caller and was cleared by a reply citing ADR-0042, a "won't fix" dismissal and thread resolution. The dismissal is limited to z-shell/.github/.github/workflows/*@main references, so third-party and organization-action pins are still reported. The claim that default setup cannot filter queries holds: default setup takes no configuration file, and 57 of 94 unarchived repositories use it for Actions.
• Links: pass. The ADR's relative link resolves to knowledge/domains/ci/workflow-contract.md, and the issue link points to #809.
• Verification: pass. All seven organization validators and 339 unit tests pass locally; whitespace and Trunk pass on the three files; all 12 hosted checks pass on this head, and the commit signature is verified.

This is an author-side review of record, not independent human approval. No threads or comments were open at publication.