Session Handoff [auto-1935]: Placeholder the Bare-Tag Pin Example and Scan For It

[ptr727]

Next steps, in priority order

1. Fix GOVERNANCE.md Workflow YAML Conventions Names a Three-Part Version in Its Pin Example #1935. In GOVERNANCE.md "Workflow YAML Conventions", Action pinning bullet, replace the bare-tag example # 1.4.2 with a placeholder (for example # X.Y.Z beside # vX.Y.Z), per "Documentation Style Conventions" on three-part versions in carried instruction files. Sweep every other surface that carries or includes that bullet (generated skill includes via scripts/build_dist.py, .github/skills, .claude-plugin) so no copy keeps the literal.
2. Make the hub's own version-literal scan catch this shape, per the issue's Expected section: find why the hub run of spec/audit.py (version_literals_outside_verbatim and its caller) did not report # 1.4.2 inside the verbatim section, extend it so it does, and add a test that fails on the old text and passes on the new (revert the fix to prove the test).
3. Done looks like: one PR into develop, body carrying Closes on promotion: #1935, local gates green, local-strict-review pass recorded, review loop driven to merge per drive-pr, scope develop.

External blockers

None known. Reviewer quota is the usual risk; a refused or never-recorded Copilot request is a STOP, not a wait.

Internal dependencies

Step 2's test should be written against the current text first so it demonstrates the gap before step 1 removes the literal.

State

No branch or worktree yet. Base the worktree on develop on branch feature/auto-1935. No open pull request names #1935.

The parked decision queue

0 parked decisions on this lane.

What the last round did

Picker created this lane from the open backlog.

What not to repeat

Nothing attempted yet.

New learnings

None.

[ptr727]

Lane closed out. PR #1962 merged to develop as f71a925 (scope develop). It placeholders the bare-tag pin example in GOVERNANCE.md "Workflow YAML Conventions" as # X.Y.Z, and it moves the version-literal pattern into spec/validate.py so the hub's pull request gate scans the four instruction documents whole, verbatim sections included. #1935 closes on promotion. The root cause was that the audit's hub run caught the literal, but no pull request gate ran that scan. No lesson or decision issue was filed.