feat: implement issue #1267 — Standards sweep and compliance audit accept a stale channel major, so a stub on an orphaned <agent>/v<old>-<tier> is never re-pinned (dev-lead: 5 repos stuck on v1-stable)
Problem
Standards sweep and compliance audit accept a stale channel major, so a stub on an orphaned /v- is never re-pinned (dev-lead: 5 repos stuck on v1-stable)
From the issue: Five consumer repos pin dev-lead/v1-stable. Promotion only moves the dev-lead/v139-* tags, so those repos never receive a dev-lead release. Neither standard routine notices:
Risk
Low — changes automation shell logic under scripts/, covered by shellcheck (--severity=warning) and the bats suite.
Test plan
Tests added/updated: test/scripts/compliance-audit/centralized-stub-pins.bats,test/scripts/compliance-audit/dev-lead-stub-channel-sync.bats test/scripts/compliance-audit/stale-channel-major-agreement.bats,test/scripts/deploy-standard-workflows/emit-vform.bats test/scripts/lib/ring-pins.bats,tests/test_seed_repo_template_workflows.bats. Verification: bash scripts/dev-lead-lint.sh (shellcheck --severity=warning) ran pre-commit; the bats suite runs in CI.
Rollback
Revert this PR. No non-revertible side effects (no tags, migrations, or external state).
Monitoring
This PR's Lint (shellcheck) and bats checks show pass/fail; watch subsequent dev-lead / pr-review runs for behavioral regressions.
Closes #1267