fix(ci/crypto/lfs): update ceremony rustfmt, differential test, LFS attributes, and workflow pins

.github/workflows/ten_out_of_ten_release_gate.yml

@@ -20,25 +20,31 @@ jobs:
     name: Research Evidence, Claims & Security Gate
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 0
 
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # pinned 1.98
         with:
           toolchain: 1.98.0
           components: rustfmt, clippy
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
         with:
           python-version: '3.11'
 
-      - name: Python Package Install & Import Smoke Test
+      - name: Install Lean 4 Compiler (Elan)
+        shell: bash
+        run: |
+          curl -sSf https://raw.githubusercontent.com/leanprover/elan/master/elan-init.sh | sh -s -- -y --default-toolchain leanprover/lean4:v4.8.0
+          echo "$HOME/.elan/bin" >> $GITHUB_PATH
+
+      - name: Python Package & Full CLI Smoke Test
         shell: bash
         run: |
           python -m pip install --upgrade pip
-          python -m pip install -e .
-          python -c "import sys; sys.path.insert(0, 'crates/zymatica-agent-harness'); import zymatica_cli; print('zymatica_cli ok')"
+          python -m pip install -e ".[cli]"
+          python -c "import sys; sys.path.insert(0, 'crates/zymatica-agent-harness'); import zymatica_cli, cli; print('zymatica_cli & cli module loaded')"
 
       - name: Resolve evidence directory
         id: evidence
@@ -77,7 +83,7 @@ jobs:
         run: python scripts/package_release_evidence.py
 
       - name: Upload evidence bundle artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
         with:
           name: release-evidence-manifest
           path: ${{ steps.evidence.outputs.dir }}/