fix(catalog): sync drifted action pins and remove a dead input

[rldyourmnd]

Summary

Two source-of-truth defects found while auditing semantic entropy across the estate, plus one stale doc.

The catalog was wrong about four action pins. catalog/tools.yml recorded a pin for setup-node, setup-java, setup-swift and checkov-action that appears in no workflow — setup-swift by a full major version (v2.4.0 recorded, v3 shipped). Since .claude/CLAUDE.md declares the catalog the source of truth, anyone auditing supply-chain posture from it got four wrong answers.

The reason it rotted silently: validate_catalog.py checked the pin's shape (PIN_RE) and that used_by paths exist, but never that the recorded pin is the pin actually used.

sql-ci.yml declared a python_version input that nothing reads. It is the only never-read input across all 42 reusables. The workflow has no setup-python step at all — it provisions Python via setup-uv + uvx sqlfluff. A caller writing with: { python_version: '3.11' } got a silently ignored value: a false contract, not just dead weight. The line-3 header comment claiming "pinned setup-python" was wrong for the same reason.

Type of change

• Fix to an existing workflow
• Pinned tool/action version bump — catalog records synced to reality; no workflow pin changed
• Hardening / security posture improvement

Threat-model note

No workflow behavior, token scope, or egress changes. The python_version removal narrows a reusable's workflow_call interface — safe here because no caller in the estate passes it (verified across all four repos and examples/), and it was inert regardless.

The security-relevant change is the new validator: a catalog that silently disagrees with the workflows is worse than no catalog, because it is consulted instead of reading the workflow.

Permissions diff

None. No permissions: block is touched.

Checklist

• All third-party actions pinned to a full 40-char commit SHA — unchanged; the catalog now matches them
• Least-privilege permissions — untouched
• concurrency and timeout-minutes present — untouched
• persist-credentials: false — untouched
• No ${{ ... }} inside run: — untouched
• Paid public/GHAS actions absent from private-free/cross-tier files — untouched
• actionlint passes locally
• zizmor --pedantic passes locally
• README capability table and docs/ / catalog/ updated
• CHANGELOG.md updated under [Unreleased]
• Commits are signed (-S) and signed off (-s, DCO); Conventional Commit

Tier impact

• Public (free OSS suite)
• Private free tier
• Private paid tier

(sql-ci.yml is a both-tiers reusable; the catalog covers every tier.)

Verification

python3 scripts/validate_all.py exits 0. actionlint clean.

The new check was proven by negative control, not just by passing: reintroducing the old setup-node SHA into the catalog makes validate_catalog.py fail with

tool `setup-node`: catalog pin 48b55a011b… does not match 8207627860… used in .github/workflows/benchmark.yml

for all three used_by workflows, and restoring it makes the gate green again. A validator that has never been seen to fail is not evidence.