Pinning Isn't Paranoia: Hardening the CI That Ships ego-lite

How an unpinned action and a fork bomb of concurrency taught me more about CI hardening than any tutorial—and the two-zone architecture that fixed both.