Fix org baseline audit drift

[NWarila]

Summary

• Track ADR 0011 and the example Mermaid source through the deny-all allowlist and baseline manifests.
• Harden reusable security gates by pinning zizmor 1.25.2, running the pedantic gate, removing advisory bypass inputs, and repairing the Scorecard full-SHA pin.
• Add bounded retry handling to the repo-hygiene OPA download while keeping checksum verification.

Verification

• python tools/check_baseline_manifest.py
• python tools/check_docs_layout.py
• python tools/check_adr_schema.py
• opa test policies/opa
• python tools/build_opa_input.py | opa eval --fail-defined --format pretty --stdin-input --data policies/opa 'data.repo_hygiene.deny[_]'
• actionlint
• zizmor --persona pedantic .github/workflows
• markdownlint-cli2 **/*.md
• relative Markdown link check
• workflow SHA resolver: 11 external action pins resolved