Security/remediate track c track e

[hyperpolymath]

Summary

Closes #

Type of change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 💥 Breaking change (would change existing behaviour)
• 🕳️ Soundness fix (fixes a checker/proof false-negative)
• 📖 Documentation
• 🧹 Refactor / tech debt (behaviour-preserving)
• ⚡ Performance
• 🔧 Build / CI / tooling

How has this been verified?

Checklist

• My commits are signed (git commit -S).
• I ran the project's own checks/tests locally and they pass.
• New files carry the correct SPDX-License-Identifier (code/config MPL-2.0,
  prose CC-BY-SA-4.0); I did not relicense existing files.
• Docs are updated, and no public claim now overstates what the code does.
• I have not introduced a soundness hole (or I have flagged where I might have).

Notes for reviewers

---

Summary by Gitar

• CI/CD Workflows:
  • Adopted standards reusable workflows for governance, scorecard, and hypatia-scan across GitHub Actions.

_{This will update automatically on new commits.}

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

Code Review ✅ Approved

Adopts standardized reusable workflows for scorecard, hypatia, and governance across CI configurations. No issues found.

Auto-approved and auto-merge armed: No blocking issues found.
Please see Auto-approve Docs for details on setting custom approval criteria. — merges when pipeline and required approvals pass.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[gitar-bot]

⚠️ Gitar auto-approved this PR but could not enable auto-merge: auto-merge is disabled for this repository — enable "Allow auto-merge" in the repository settings.

[gitar-bot]

Gitar has auto-approved this PR and enabled auto-merge (configure)