fix(catalog): stop assuming publisher bought paid GitHub security products

[rldyourmnd]

Summary

Stop treating the publisher as a buyer of GitHub Enterprise Cloud, Code Security, Secret Protection, or Code Quality. Those remain explicitly selectable paid programmes for other consumers. This public library itself is an Organization product, not an Enterprise account, and it keeps the free public surfaces (CodeQL, SARIF, Scorecard, dependency review, attestations).

A live GitHub plan.name belongs to one organization. GET /orgs/NDDev-OpenNetwork returning plan.name=free is operator evidence for that org only; other organizations, including other NDDev accounts, were not queried and must resolve their own plan. Public docs do not copy that field and also refuse the inverse claim that this organization is on the free plan.

Private repositories without those purchases use the private-free programme and release-supply-chain-free.yml. The SARIF private bundle keeps a dedicated paid example. Profile ids public-enterprise-max and enterprise-full-private-fixed80 are unchanged.

Consumer adoption now checks out the user-selected immutable release tag and resolves the programme from that same SHA (the value written in uses: ...@<sha>). It does not check out main or freeze a latest-release date/SHA. Private attestations remain an Enterprise Cloud plan gate; Code Security, Secret Protection and Code Quality do not unlock them. Public free CodeQL/attestations stay explicit.

Issues

• Declare reusable-workflow consumption alongside git submodules #86 / fix(gds): declare both gitlink and reusable-workflow consumption #87 are source-only. Declare reusable-workflow consumption alongside git submodules #86 is closed and fix(gds): declare both gitlink and reusable-workflow consumption #87 is merged as a GDS consumption-declaration fix in this repository. This PR does not claim downstream consumer adoption, pin rollout, or GDS inventory acceptance.
• Does not close [CI feedback] workflow 341408090: run 34091935173/1 #93/[CI feedback] workflow 335161293: run 34091813231/1 #94: those are background CI on other SHAs.

Type of change

• New reusable workflow / capability
• Fix to an existing workflow
• Pinned tool/action version bump
• Hardening / security posture improvement
• Docs only

(Docs/catalog/examples/skills/tests; one reusable comment; one new paid caller example.)

Threat-model note (required for workflow / permission changes)

nddev-security-bundle.yml behaviour and job permissions are unchanged. Comments now state it requires Code Security. The publisher-org private example no longer calls the SARIF bundle. The new examples/private-paid-ghas/security-selfhosted.yml is the explicit paid caller and grants actions: read + security-events: write. Public self-CI still uses CodeQL, zizmor SARIF, Scorecard, and attested release — free on public repositories.

Permissions diff (required for workflow / permission changes)

Reusable jobs: none.

Example caller examples/private-paid-ghas/security-selfhosted.yml (new):

security-bundle:
  permissions:
    actions: read           # upload-sarif reads this workflow run
    contents: read          # scan the caller checkout
    security-events: write  # publish zizmor SARIF to code scanning

Checklist

• All third-party actions pinned to a full 40-char commit SHA with a
  release-version or matching # commit:<full SHA> comment (no tags/branches).
• Least-privilege permissions (top-level {}, per-job minimal scopes).
• concurrency and timeout-minutes present on new/changed workflows/jobs.
• persist-credentials: false on all read-only actions/checkout steps.
• No ${{ inputs.* }} / ${{ github.event.* }} interpolated inside run:
  (passed via env: and referenced as shell variables).
• Paid public/GHAS actions are absent from private-free/cross-tier files;
  SARIF/no-SARIF behavior is split into explicit workflow contracts.
• actionlint passes locally.
• zizmor --pedantic passes locally (no template-injection or unpinned
  findings).
• README capability table and docs/ / catalog/ updated (if a workflow
  was added or changed).
• CHANGELOG.md updated under [Unreleased].
• Commits are signed (-S) and signed off (-s, DCO); Conventional Commit
  messages.

Authorship of source commits: rldyourmnd <danil@nddev.it.com>. Merge is for independent coordinator review of that authorship, without waiting on the wide background CI matrix.

Tier impact

• Public (free OSS suite)
• Private free tier (zero-cost only)
• Private paid tier (GHAS / harden-runner features)

Verification (head 56e118e502a5e965717bd0ab1550aa8007a13286, base b4aaab59dc674923817ad11f3fe5801ed5a47935)

Changed paths resolved via git diff --name-only b4aaab59...HEAD (31 files).

.venv/bin/python -I -B scripts/check_python_execution_contract.py --launch \
  validate_all.py -- --tier touched --changed-from b4aaab59dc674923817ad11f3fe5801ed5a47935

• [ OK ] product-facts-touched
• validate_all (touched): OK

GH_TOKEN=$(gh auth token) .venv/bin/python -I -B scripts/check_python_execution_contract.py --launch \
  validate_all.py -- --changed-from b4aaab59dc674923817ad11f3fe5801ed5a47935

• validate_all (all): OK including core, product-facts-touched, and advisory product-facts-calendar, release-ledger-tags, consumer-skill-release, docs-links, cache-upstream-defaults, flutter-pin, qt-pin, transitive-action-pins, anchor-contexts.
• No advisory failures to report on this head.

Static validation is not reusable runtime evidence. No new fixture run is claimed.

Settings follow-up (not applied)

Read-only. Coordinator-owned plan→approve→apply. Fleet resources were not touched.

• GET /orgs/NDDev-OpenNetwork only: type=Organization, plan.name=free, enterprise=null, seats=0. Operator evidence for this org. Other orgs were not queried.
• Org code-security configurations: only GitHub recommended (id=17, enforcement: unenforced). No nddev-config.
• This public repo: secret scanning + push protection enabled; code scanning default not-configured; Dependabot security updates disabled; Actions sha_pinning_required: true at repo and org.
• Do not buy/enable Code Security, Secret Protection, Code Quality, or Enterprise in this task.