ci: address review — check writes too, pin deps, harden the spec pin

Review feedback from CodeRabbit and Copilot on #934. All six findings were
valid; one is fixed the other way round from how it was suggested.

Key-coverage now checks manifest WRITES as well as reads. Copilot correctly
spotted that `ast.walk` ignored subscript context, so
`manifest["year"] = ...` (lib/songmeta.py) scored as a read — but the fix is
not to drop writes. A key core *writes* is spec surface pointed outward: it
lands in every pack we emit, so an undeclared one seeds the ecosystem with
non-spec data. Subscripts are now classified by ctx (Store = write, Load =
read) and both sets are checked, with distinct error messages. Today: 19
reads, 2 writes, all declared.

Workflow:
- persist-credentials: false on the repo checkout — the job runs repository
  code and never pushes (CodeRabbit / zizmor artipacked).
- .feedpak-spec-ref must be a full 40-char SHA. actions/checkout resolves
  branches and tags in `ref` too, so a non-SHA there would silently un-pin
  the spec — precisely what the file exists to prevent.
- Pin jsonschema==4.26.0, for the same reason the spec SHA is pinned: an
  upstream release must not redden this job on a PR that changed neither
  this repo nor the spec.

Script:
- check_forward() guards a missing examples/ dir instead of raising an
  unhandled FileNotFoundError.
- TemporaryDirectory() instead of mkdtemp(), so a local run doesn't leak.

Signed-off-by: topkoa <topkoa@gmail.com>

.github/workflows/ci.yml

@@ -137,6 +137,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        # This job runs repository code (tools/check_spec_conformance.py) and
+        # never pushes; don't leave the token in git config for it.
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-python@v5
         with:
@@ -151,6 +155,13 @@ jobs:
             echo "::error file=.feedpak-spec-ref::no commit SHA found in .feedpak-spec-ref"
             exit 1
           fi
+          # actions/checkout resolves branches and tags in `ref` too, so a
+          # non-SHA here would silently un-pin the spec — the one thing this
+          # file exists to prevent. Demand a full 40-char SHA.
+          if ! printf '%s' "$sha" | grep -qE '^[0-9a-fA-F]{40}$'; then
+            echo "::error file=.feedpak-spec-ref::expected a full 40-character commit SHA, got '$sha' — a branch or tag name would defeat the pin"
+            exit 1
+          fi
           echo "sha=$sha" >> "$GITHUB_OUTPUT"
 
       - name: Check out feedpak-spec at the pinned commit
@@ -167,8 +178,10 @@ jobs:
           pip install -r requirements.txt
           # CI-only: the spec's reference validator needs jsonschema. Not a
           # runtime dependency — this gate never runs on the serve/Docker path
-          # (constitution Principle I).
-          pip install jsonschema
+          # (constitution Principle I). Pinned for the same reason the spec SHA
+          # is: an upstream release must not turn this job red on a PR that
+          # changed neither this repo nor the spec.
+          pip install 'jsonschema==4.26.0'
 
       - name: Check feedpak spec conformance
         run: python tools/check_spec_conformance.py --spec .feedpak-spec