fix(ci): resolve 4 failing checks blocking PR #26

- ada.yml: specify -P modshells.gpr (multiple .gpr files need explicit project)
- rsr-antipattern.yml: exclude tests/ from TS blocker (Deno test files)
- dogfood-gate.yml: SHA-pin k9-validate-action and a2ml-validate-action
- hypatia-scan.yml: fix upload-artifact SHA (was non-existent commit)
- Fix SPDX headers (MPL-2.0-or-later → PMPL-1.0-or-later)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/ada.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: MPL-2.0-or-later
+# SPDX-License-Identifier: PMPL-1.0-or-later
 name: Ada (GNAT)
 
 on:
@@ -27,4 +27,4 @@ jobs:
         sudo apt-get install gnat gprbuild
 
     - name: Build
-      run: gprbuild -j0 -p
+      run: gprbuild -P modshells.gpr -j0 -p

.github/workflows/dogfood-gate.yml

@@ -38,7 +38,7 @@ jobs:
 
       - name: Validate A2ML manifests
         if: steps.detect.outputs.count > 0
-        uses: hyperpolymath/a2ml-validate-action@main
+        uses: hyperpolymath/a2ml-validate-action@edad26fc392d7d9fd3d02f67ef131e26a7179a72 # main
         with:
           path: '.'
           strict: 'false'
@@ -86,7 +86,7 @@ jobs:
 
       - name: Validate K9 contracts
         if: steps.detect.outputs.k9_count > 0
-        uses: hyperpolymath/k9-validate-action@main
+        uses: hyperpolymath/k9-validate-action@66cd8fea58e9b660260d1928bea266414b535396 # main
         with:
           path: '.'
           strict: 'false'

.github/workflows/hypatia-scan.yml

@@ -76,7 +76,7 @@ jobs:
           echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY
 
       - name: Upload findings artifact
-        uses: actions/upload-artifact@65c79d7f54e76e4e3c7a8f34db0f4ac8b515c478 # v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: hypatia-findings
           path: hypatia-findings.json

.github/workflows/rsr-antipattern.yml

@@ -1,6 +1,6 @@
-# SPDX-License-Identifier: MPL-2.0-or-later
+# SPDX-License-Identifier: PMPL-1.0-or-later
 # RSR Anti-Pattern CI Check
-# SPDX-License-Identifier: MPL-2.0-or-later
+# SPDX-License-Identifier: PMPL-1.0-or-later
 #
 # Enforces: No TypeScript, No Go, No Python (except SaltStack), No npm
 # Allows: ReScript, Deno, WASM, Rust, OCaml, Haskell, Guile/Scheme
@@ -29,7 +29,7 @@ jobs:
         run: |
           # Exclude bindings/deno/ - those are Deno FFI files using Deno.dlopen, not plain TypeScript
           # Exclude .d.ts files - those are TypeScript type declarations for ReScript FFI
-          TS_FILES=$(find . \( -name "*.ts" -o -name "*.tsx" \) | grep -v node_modules | grep -v 'bindings/deno' | grep -v '\.d\.ts$' || true)
+          TS_FILES=$(find . \( -name "*.ts" -o -name "*.tsx" \) | grep -v node_modules | grep -v 'bindings/deno' | grep -v '\.d\.ts$' | grep -v '^./tests/' || true)
           if [ -n "$TS_FILES" ]; then
             echo "❌ TypeScript files detected - use ReScript instead"
             echo "$TS_FILES"