Decide: Should the uses: pins in catalog/snippets/workflows/ stay SHA pins, or move to fetching the hub's latest the way the doc gates do through hub_fetch_run.py? (Bumping the four stale pins is ordina? #3745

Split from #1666 by decision triage. Only this undecided item waits on the maintainer. The rest of #1666 stays there as ordinary work.

Decision needed (decision triage, 2026-11-01)

Question: Should the uses: pins in catalog/snippets/workflows/ stay SHA pins, or move to fetching the hub's latest the way the doc gates do through hub_fetch_run.py? (Bumping the four stale pins is ordinary work.)

Options, recommended first:

1. Keep the pin, add one sentence on why (recommended): The rule already settles it: the downstream uses: pin is the one Dependabot maintains, and "never pinned" covers only what Dependabot does not. One sentence in GOVERNANCE.md "Hub-Hosted Tooling" closes the tension; how stale the hub-side snippet gets is Adopter docs and catalog snippets hardcode a pin, so every one of them is stale #1472's question. No work in flight.
2. Keep the pin, change no text: Same outcome, with the two rules side by side and nothing linking them. No work in flight.
3. Use a floating ref such as @main: Not workable: repo_gate.py's sha-pin check rejects a floating ref, and GOVERNANCE.md says the pin is what lets a passed change re-run identically. No work in flight.

Evidence: GOVERNANCE.md:151: a workflow "pins it to a commit SHA ... The pin is what makes a released repository's gate reproducible ... uses: takes no expressions". GOVERNANCE.md:296: doc gates are "never vendored and never pinned. Pinning anything Dependabot does not maintain goes stale by construction". docs/reusable-workflows.md:63: Dependabot "keeps reusable-workflow references current". check_sha_pin reports "is a floating ref, not a 40-hex SHA". Current snippet pins: test-pull-request.yml 2.0.1166 (#3466), publish-release.yml and test-pull-request-smoke.yml 2.0.1122 (#3313), both past fix 3d13223; merge-bot-pull-request.yml (2.0.338) and run-periodic-codegen-pull-request.yml (2.0.352) still old.

Blocks: none