Record the three releases the CHANGELOG skipped, and re-pin to ci-v3.2.1

[hseshadr]

What this is

ci-v3.2.1 is already cut — annotated tag at 605e51c, release live. This PR is the commit that always follows a release in this repo: record the release SHA and re-pin every first-party ref. Same shape as 8d46d90 ("Re-pin every first-party ref to ci-v2.0.3 and record the release SHA") and e22b4bf.

The tag had to come first — a commit cannot contain its own SHA, so the Commit <sha>. line can only be written after the tag exists. That is the documented release-commit bootstrap.

Two things are fixed

1. The CHANGELOG had no record of two releases that already shipped. Its heading still read Unreleased (on main, after ci-v3.0.0) while ci-v3.1.0 and ci-v3.2.0 were both cut on 08-03. Nine of the ten bullets under it described work that had already shipped in ci-v3.1.0. I verified that per bullet by checking each one's artifact into the tree at 33c5e5f:

bullet	artifact	at ci-v3.1.0
examples checked against their repos	tests/example-fidelity.sh	present
both polarities are fixtures	tests/example-fidelity-cases.sh	present
allowlist entry covers one control	tests/consumer-drift-cases.sh	present
Ruby is pinned	.ruby-version (3.4.10)	present
shared-libs-python to edgeproc-core	examples/edgeproc-core/	present
drift detector / secret-scan example	secret-scan job in examples/aml-filter/ci.yml	present
security-audit refuses to audit nothing	configured: job	present

So renaming that heading to ci-v3.2.1 wholesale would have billed nine shipped entries as new and told consumers to re-pin for work they already have. Each release now gets its own section and its own SHA:

release	commit	what it is
ci-v3.2.1	605e51c	the publish-verification bound (#16)
ci-v3.2.0	7226072	the re-pin that makes setup-uv v9 actually run
ci-v3.1.0	33c5e5f	setup-uv v9 in the composite, plus PRs #9-#14

ci-v3.1.0 is marked do-not-pin, the way ci-v2.0.0 already is: its tree runs the v9.0.0 composite but its own refs still name ci-v3.0.0, so pinning that tag executes v8.3.2 — the exact split it set out to close.

2. Every first-party ref moves to ci-v3.2.1 — 41 refs across 23 files (9 in .github/, 32 in examples/). Not bookkeeping: without it this branch is red. See below.

The claim this PR touches

"Every first-party uses: ref names the newest release." — the currency half of validate_first_party_release_lineage.

Watched it fail. With HEAD off the tagged commit the bootstrap exemption stops firing. Reverting one pin (python-gate.yml) back to ci-v3.2.0:

FAIL: first-party ref 7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 is a superseded release,
      not ci-v3.2.1 (605e51cbc86f452b56edcf1c9660921da797cbfe) — re-pin
      (.github/workflows/python-gate.yml)
1 security policy check(s) failed.
exit 1

Restored, it prints Security policy checks passed. (exit 0). tests/lineage-guard-cases.sh also passes (exit 0).

That is also the proof a CHANGELOG-only commit would have reddened main: every one of the 41 refs was in exactly that state before this commit.

Diff shape

• CHANGELOG.md — the only file with prose changes.

• 23 workflow/example files — pin lines only. This prints 0:

  git diff main...HEAD -- .github examples | grep -E '^[+-]' \
    | grep -vE '^(\+\+\+|---)' | grep -vcE 'hseshadr/ci/'

  All 41 new pins carry the exact comment # ci-v3.2.1; no comment names a version other than its SHA's tag.

Not in this PR

• Consumer pins. 6-consumer-pins.sh owns those and opens one PR per consumer repo. It explicitly skips ci itself (# ci pins its own actions; it is the source of the release, not a consumer), which is why ci's own 41 self-pins are here.
• Three pre-existing defects, reported not fixed. No existing tag was moved.
  • ci-v3 points at 72521e7 (a Dependabot merge from PR ci: Bump actions/checkout from 7.0.0 to 7.0.1 #5), not at the newest 3.x release. The CHANGELOG header says the ci-vN pointer moves to the newest release in that major. Blast radius is limited because tests/security-policy.sh rejects a moving @ci-vN ref, but the pointer is public and wrong.
  • ci-v3 and ci-v3.0.0 are lightweight tags. ci-v3.1.0, ci-v3.2.0, ci-v3.2.1 and every ci-v2* are annotated, which is the house rule.
  • The ci-v3.2.0 GitHub release has an empty body.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.