ci: bump the standards-sync contract to the linkage-compliant template

[kyle-sexton]

What

Register standards-sync.yml@0b45b9f in the runner policy (contract body copied from the reviewed ec91c343 entry), record the lockstep provenance note, and move sync.yml's pin to it.

Why

The sync wave still ran standards-sync@ec91c34, which predates the PR-body template fix — every distributed sync PR failed its target's pr-issue-linkage gate and needed a hand-patched body (dotfiles#225, provisioning#175, claude-code-plugins#345 this wave). The ec91c343..0b45b9f diff for the reusable is confined to the body heredoc: it adds the "No linked issue" sentence and a ## Related section (melodic-software/ci-workflows#146); inputs, secrets, permissions, and routing are unchanged.

Verification

224/224 runner-policy component tests pass; the policy engine passes with public visibility evidence; actionlint clean on sync.yml; markdownlint + biome + lefthook gauntlet green.

Related

No linked issue. melodic-software/ci-workflows#146 (template fix), #200 (public posture this builds on).

🤖 Generated with Claude Code

https://claude.ai/code/session_01YZxBP1B8Hf7ZRaqDrP6ma9

[claude]

Claude finished @kyle-sexton's task in 1m 39s —— View job

---

Code Review

• Gather context and read changed files
• Review policy.json — new contract entry correctness
• Review README.md — provenance note accuracy
• Review sync.yml — pin update correctness
• Post findings

---

Summary: The change is narrowly scoped and internally consistent. No blocking issues found.

policy.json — new contract entry

The new 0b45b9f entry is byte-for-byte identical to the existing ec91c343 entry — same routing, runnerInput, allowedInputs, and allowedSecrets. That's the correct approach when only the body heredoc changed upstream: the security surface is unchanged, so the contract review carries over. No secrets are introduced; the values remain template-expression references to existing Actions secrets. ✅

The ec91c343 entry is correctly retained rather than removed (old entries stay as the audit trail for any consumers still on that pin). ✅

sync.yml — pin update

The full SHA in the uses: line (0b45b9fb1755649455e3bb2b9c56c619a412b06b) matches the key added to policy.json exactly. The inline comment (# 0b45b9f 2026-07-18) correctly abbreviates to 7 chars and carries the right date. ✅

README.md — provenance note

The provenance note correctly describes the scope of the upstream diff, attributes it to ci-workflows#146, and confirms the security-relevant fields are unchanged. One minor inconsistency worth noting:

🟡 Nit — The README spells out the predecessor as ec91c343 (8 hex chars) while the sync.yml inline comment and the PR body both use ec91c34 (7 chars). The style elsewhere in this file uses the shorter 7-char form (e.g., the PR body, the sync.yml comment). The 8-char form is unambiguous, but a uniform abbreviation length would be more consistent with the rest of the document. Fix this →

---

LGTM. The security surface of the new entry is identical to the reviewed predecessor, the diff is purely cosmetic (PR body template), and the three-file change is internally consistent.