ci: align terraform checkout SHA, add pnpm audit to TS CI, fix PR template and ORG_SETTINGS

.github/PULL_REQUEST_TEMPLATE.md

@@ -91,9 +91,9 @@ Closes #
 - [ ] **Schema.org compliance** — new database tables, columns, or API fields
       map to Schema.org types, or the PR description justifies any deviation.
 - [ ] **Locked counts respected** — no change to the platform's locked counts
-      (17 mini-apps · 7 Enterprise products · 7 data layers · 7 covenants ·
-      40 interest categories · 12 manifesto sections · 3 sources of truth)
-      without Founder approval documented in the PR description.
+      (17 mini-apps · 7 data layers · 7 covenants · 40 interest categories ·
+      12 manifesto sections · 3 sources of truth) without Founder approval
+      documented in the PR description.
 - [ ] **Frontier defaults** — for user-facing or infrastructure work:
       offline / local-first behaviour has been considered; any new
       cryptographic primitive has a documented post-quantum migration path;

.github/workflows/reusable-ci-terraform.yml

@@ -57,7 +57,7 @@ jobs:
     outputs:
       terraform: ${{ steps.filter.outputs.terraform }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v6
         with:
           fetch-depth: 0
       - id: filter
@@ -76,7 +76,7 @@ jobs:
     if: needs.changes.outputs.terraform == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v6
       - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e  # v4.0.1
         with:
           terraform_version: ${{ inputs.terraform-version }}
@@ -99,7 +99,7 @@ jobs:
     if: needs.changes.outputs.terraform == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v6
       - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e  # v4.0.1
         with:
           terraform_version: ${{ inputs.terraform-version }}
@@ -128,7 +128,7 @@ jobs:
     if: needs.changes.outputs.terraform == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v6
       - uses: terraform-linters/setup-tflint@b480b8fcdaa6f2c577f8e4fa799e89e756bb7c93  # v6.2.2
         with:
           tflint_version: ${{ inputs.tflint-version }}

.github/workflows/reusable-ci-typescript.yml

@@ -62,6 +62,23 @@ permissions:
   contents: read
 
 jobs:
+  audit:
+    name: pnpm audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v6
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271  # v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6
+        with:
+          node-version-file: ${{ inputs.node-version-file }}
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - name: pnpm audit
+        shell: bash
+        run: |
+          set -euo pipefail
+          pnpm audit --audit-level=moderate
+
   typecheck:
     name: tsc
     runs-on: ubuntu-latest

ORG_SETTINGS.md

@@ -95,6 +95,8 @@ At **Settings → Actions → General**:
   aquasecurity/trivy-action@*,
   sigstore/cosign-installer@*,
   opentofu/setup-opentofu@*,
+  hashicorp/setup-terraform@*,
+  terraform-linters/setup-tflint@*,
   actions/attest-build-provenance@*
   ```
 
@@ -366,8 +368,10 @@ specific repositories, branches, and environments.
 ### Cloudflare example
 
 ```yaml
+# Resolve the SHA before use:
+# gh api repos/cloudflare/cloudflare-action/git/refs/tags/<tag> --jq '.object.sha'
 - name: Authenticate to Cloudflare via OIDC
-  uses: cloudflare/cloudflare-action@v1   # pin to SHA per NA-03 §7.1.1
+  uses: cloudflare/cloudflare-action@<40-char-sha>  # vX.Y.Z — per NA-03 §7.1.1
   with:
     api-token: ${{ secrets.CLOUDFLARE_API_TOKEN }}  # narrow-scope token
 ```