chore(ci): stamp supply chain policies via charter stamp-policies

[stackbilt-admin]

Summary

• SHA-pins 4 floating action tags (actions/checkout@v6, actions/setup-node@v6) in ci.yml and publish.yml to verified commit SHAs
• Adds .github/workflows/supply-chain.yml: SBOM generation + dependency review callers sourced from Stackbilt-dev/stackbilt_llc reusable workflows (pinned to 006a05aa)
• Installs .charter/patterns/floating-action-pins.json drift guard — future floating pins will be caught by charter drift
• Enables charter drift scanning on .github/workflows/*.yml

Applied via

charter stamp-policies \
  --path . \
  --policy-repo-ref 006a05aa3f37966207e0a2068a947715a91536be

Test plan

• CI passes on this branch
• SBOM artifact uploads on push to main after merge
• Dep-review runs (and blocks on HIGH severity) on subsequent PRs
• charter drift --path . reports zero floating-action-pins violations

Note: Cross-repo reusable workflows in a private GitHub org require:
Org Settings → Actions → General → "Allow all actions and reusable workflows"

Governed-By: Stackbilt-dev/stackbilt_llc#11

🤖 Generated with Claude Code

[stackbilt-admin]

Review pass on this consumer PR: rollout is clean and the SHA pin conversion + policy wiring look correct. One critical sequencing follow-up before merge:

• supply-chain.yml currently references Stackbilt-dev/stackbilt_llc workflows at 006a05aa..., which is a commit from an open PR branch. Re-stamp this repo to the post-merge stackbilt_llc/main commit SHA after fix: stale model catalog — missing Claude 4.5/4.6, deprecated GPT-3.5 default #12 lands, so the reusable workflow ref is anchored to a durable upstream commit on main.

Optional follow-up once upstream adjusts: if #12 pins the CycloneDX tool version and broadens floating-ref detection, pull those updates here via re-stamp as well.

[stackbilt-admin]

Acknowledged — this PR's supply-chain.yml references stackbilt_llc at 006a05aa (the open PR branch tip). Once stackbilt_llc#12 merges to main, I'll re-stamp with:

charter stamp-policies \
  --path . \
  --policy-repo-ref <merge-commit-sha>

and force-push this branch to update the uses: paths to the durable main SHA. Will note when done.