security: track hosted runner and setup-python provenance residual

[anulum]

Residual

GitHub-hosted ubuntu-24.04 runners and the official actions/setup-python action resolve platform images and exact Python patch releases through GitHub-managed manifests. The repository pins the runner release label, the setup-python action commit, and exact Python patch versions, but cannot independently bind every GitHub-provisioned runner or interpreter artifact digest through the supported action interface.

Current invariant

• no ubuntu-latest labels
• every actions/setup-python reference is a verified commit object
• every python-version is an exact 3.x.y release
• cache keys are repository-local and lockfile-bound
• project-controlled downloads and container images remain digest-bound and fail closed

Closure condition

Close only when GitHub exposes supported per-runner and per-interpreter immutable artifact identities, or when this repository adopts a fully vendored/air-gapped toolchain with equivalent hosted verification.

[anulum]

Owner disposition — accepted documented residual for the 1.0.0 release

Verified against the current main workflows that every stated invariant holds:

• no ubuntu-latest labels; hosted runners are pinned to ubuntu-24.04 (18 jobs)
• every actions/setup-python reference is one verified commit object
  5fda3b95a4ea91299a34e894583c3862153e4b97 (v7.0.0)
• every python-version is an exact patch release: 3.11.15, 3.12.13, 3.13.14
• caches are lockfile-bound; project-controlled downloads and container images
  remain digest-bound and fail closed

GitHub does not currently expose supported per-runner-image or per-interpreter
immutable artifact identities through the hosted-runner / setup-python
interface, so closure path (a) is unavailable at this date. Closure path (b) —
a fully vendored / air-gapped toolchain — is out of proportion for the current
pre-alpha scope and would introduce its own provenance surface; a partial
interpreter-only mitigation (a checksum-verified standalone toolchain) would
not address the hosted runner-image half.

This residual is therefore accepted as an explicit, documented limitation and
does not block the 1.0.0 release. The closure condition is unchanged; this
issue stays open as the tracker and will be revisited if GitHub exposes the
required immutable identities or the project adopts self-hosted / vendored
infrastructure.