docs: record the tightened repository Actions policy; fix the UPSTREAM_PIN count (#81)

Settings-only change (applied via the API): allowed actions are now an
allowlist - GitHub-owned plus astral-sh/setup-uv@* and oven-sh/setup-bun@* -
sha_pinning_required stays on, and the default GITHUB_TOKEN can no longer
create or approve pull requests. CONTRIBUTING now documents the policy and
the add-to-allowlist-first rule; the UPSTREAM_PIN bullet is corrected from
three files to four (publish-dist.yml was missed after the publisher rename;
check_pins.py already enforced all four).

Author: iap

CHANGELOG.md

@@ -13,6 +13,7 @@ All notable changes to the pstack-hermes port tooling will be documented in this
 - `.github/actions/drift-issue-upsert/`: shared composite action for the idempotent issue-by-title upsert both drift watchers need; the two callers' copies had already drifted apart (different jq expressions for the same intent).
 
 ### Changed
+- Repository Actions policy tightened (settings, not files): allowed actions are now an allowlist - GitHub-owned actions plus `astral-sh/setup-uv@*` and `oven-sh/setup-bun@*` - with `sha_pinning_required` still on, and the default `GITHUB_TOKEN` can no longer create or approve pull requests. Introducing any other action now requires a deliberate settings change. CONTRIBUTING documents the policy and the "add to the allowlist first" rule; its `UPSTREAM_PIN` lock-step bullet is corrected from three files to four (`publish-dist.yml` was missing after the publisher rename).
 - **Single-source installs.** The package now installs from this one repository: the built tree is published to its `dist` branch, which is the repository's default branch, so `hermes plugins install iap/pstack-hermes` works root-level and `hermes plugins update pstack` updates natively. The separate dist repo is retired; no second repository is ever published. (A `main`-subdir install of `pstack/` remains as a legacy pinned-style alternative.) `dist` also carries a scheduler stub so the weekly drift watchers keep firing despite the default-branch flip; manual recovery for dispatch-only workflows is `gh workflow run <file> --ref main`.
 - **Re-pin to upstream `c47b1284` (pstack v0.15.5); `pstack/` rebuilt.** Every converter anchor was re-anchored or pruned against the new upstream text (36 dead anchors at the new pin -> 0; `T8`-`T14` + delegation), **F16 retired** (upstream now ships the slug-agnostic lane check itself), `reflect`'s 4-column reviewer table adopted with the upstream `budget` key in the setup-written panel shape, and the two new upstream principles ported (`principle-attack-the-premise`, `principle-test-behavior-not-implementation`) - 45 -> 47 skills. Prose model defaults refreshed (`grok-4.7-xhigh-fast`, `claude-opus-5-5-max`); the shipped panel keeps its vendor-qualified verified slugs. `UPSTREAM_PIN` bumped in all four workflows (lock-step enforced by `tools/check_pins.py`); details and the triage correction (no `skills/orchestrate` ever existed) in `docs/ADAPTATIONS.md` section 4.
 - Docs / agent policy (Phase A, no package rebuild): `AGENTS.md` and `docs/USING.md` codify the stock-skills write surface — Hermes self-improvement (`skill_manage` / learning) targets local skills, skill taps, or a dist fork, not stock plugin skills. Stack forge freeze: **Graphite (`gt`) default**, **GitHub (`gh`) fallback**, **GitLab (`glab`) halted**. README Known limitations aligned (was incorrectly describing Graphite as optional-only).

CONTRIBUTING.md

@@ -115,9 +115,17 @@ one has already caught (or would have caught) a real defect here.
   dependency change - the usual CI gates run on the PR. The root entry does
   **not** cover `.github/actions/*/action.yml`, so each composite action with
   its own `uses:` needs a directory-scoped entry there.
+- **The repository Actions allowlist is closed.** Settings -> Actions permits
+  GitHub-owned actions plus the `astral-sh/setup-uv@*` and `oven-sh/setup-bun@*`
+  patterns only, with `sha_pinning_required` on and a read-only default
+  `GITHUB_TOKEN` (the policy lives in repository settings, not in this tree).
+  A new third-party action fails at `Set up job` with "not allowed" until its
+  `owner/repo` is added there - deliberately, so introducing an action is a
+  decision rather than an accident. Dependabot keeps already-allowed pins
+  current as usual.
 - **`UPSTREAM_PIN` moves in lock-step.** It is declared in `ci.yml`,
-  `release.yml` and `upstream-drift-watch.yml`;
-  `tools/check_pins.py` fails CI when any of the three is missing, duplicated,
+  `release.yml`, `publish-dist.yml` and `upstream-drift-watch.yml`;
+  `tools/check_pins.py` fails CI when any of the four is missing, duplicated,
   malformed, or out of step. Follow
   [docs/RUNBOOK-upstream-drift.md](docs/RUNBOOK-upstream-drift.md).
 - **Workflows must pass `actionlint`** (with `shellcheck`) - the `Lint