### Changed

- Doctrine: third-party actions never hold a write-capable token by default —
  repo-owned scripts in write-capable jobs, established publisher plus
  full-SHA pin for the exception, SHA pins everywhere. Canonical in
  REVIEWER.md, short form in BUILDER.md; consumers adopt at the pin bump
  (#216).