Verified every SHA at source rather than trusting the version comments, since a wrong SHA in a pinning PR is worse than no pin: it looks pinned, passes review, and nobody re-checks it.

Annotated tags dereferenced to their commits where needed, which is the step that makes a codeql-style pin look wrong when it is right.

The permissions change is the part I would have asked for if it were missing. Moving contents: write and id-token: write from workflow scope to job scope narrows them to the job that needs them, so every other job in that file drops to the default. id-token: write in particular is the one worth scoping tightly, since it mints OIDC tokens. Doing that in the same PR as the pinning is coherent rather than scope creep: both are about what a compromised step can reach.

Keeping the # vX.Y.Z comment beside each SHA is what makes this maintainable. A bare SHA is unreadable and gets bumped by someone pasting a newer one without checking what it is. Saying explicitly in the .github note that the SHA and the comment must be updated together is the instruction that keeps them from drifting apart.

Replicating the identical change across ca2a, cmcp and trace-spec as separate PRs rather than one is right for repos that do not share a workflow file. They are byte-identical, which I checked.

Merged.