Rokkhe

Thank you for such a thoughtful read, and I agree that read-only by default is the best first step. One thing that helps the SHA pinning stay practical: Dependabot or Renovate can bump the pinned SHAs and keep the version comment in sync, so pinning doesn't mean falling behind.