actions.lock desync on main: #595 bumped smtp-notify-action 0.3.0→0.5.0 without relocking

[hyperpolymath]

Problem

On main (head 72970698), three checks fail for one reason:

• actions.lock is in sync with the workflow YAML (scripts/check-lock-sync.sh):

  FAIL .github/workflows/push-email-notify.yml
       step-level refs missing from the lockfile: hyperpolymath/smtp-notify-action@v0.5.0
  FAIL .github/workflows/push-email-notify.yml
       stale lockfile entries, no uses: references them: hyperpolymath/smtp-notify-action@v0.3.0
  

• governance / Actions lockfile verify: "lockfile verification FAILED (exit 1)".
• scorecard / Run Scorecard (main) and scorecard / Run Scorecard PR (PRs): "Scorecard reconciliation failed: Native action-lock verification failed for .github/workflows/push-email-notify.yml". This is a different file from the casket-pages.yml failure in Scorecard reconciliation fails on casket-pages.yml (main and PRs) #589.

Cause: dependabot #595 (3d9d8bc) bumped hyperpolymath/smtp-notify-action from 0.3.0 to 0.5.0 in push-email-notify.yml and merged without regenerating .github/workflows/actions.lock.

None of the three is a required context on main, so they surface on every PR without blocking it.

Acceptance criteria

• .github/workflows/actions.lock carries hyperpolymath/smtp-notify-action@v0.5.0, resolved to its commit SHA, not the tag object (fix(ci): lock entry points at the commit, not the tag object #594 fixed that class).
• The stale @v0.3.0 entry is gone.
• The lock is regenerated with the estate tool (hyperpolymath/standards scripts/update-actions-lock.sh, verified with --verify-local), not hand-edited. The lock change does not rewrite any workflow uses: line.
• actions.lock is in sync with the workflow YAML, governance / Actions lockfile verify and scorecard / Run Scorecard are green on a main run.
• No check closed by muting it: no continue-on-error, no demotion, no removal from a workflow.

Deferral issue under AGENTS.md §5c item 3, filed from #603.