ci: converge on l9-ci-core@v1 kernels + repo hygiene

.github/workflows/ci.yml

@@ -13,7 +13,7 @@ jobs:
       matrix:
         node: ["20.19.0", "22.23.1", "24.18.0"]
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: ${{ matrix.node }}
@@ -43,7 +43,7 @@ jobs:
     needs: node
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
         with:
           name: package-contract

.github/workflows/publish.yml

@@ -9,7 +9,7 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 24.18.0

.github/workflows/supply-chain.yml

@@ -9,7 +9,7 @@ jobs:
   sbom:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 24.18.0

tools/pr-remediation/README.md

@@ -0,0 +1,32 @@
+# PR Remediation Tooling (Historical)
+
+These scripts were used to rebuild and push a stacked chain of pack-remediation
+commits across a set of open pull requests against `Quantum-L9/LLM-Router`
+(referenced PR numbers: 2, 8-17, 18). They fix historical defects such as:
+
+- `fix-boundary-chain.sh` — adds the provider-boundary ESLint rule to PR stages
+  that lacked it.
+- `fix-eslint-chain.sh` — patches `eslint.config.js` so the required `eslint .`
+  check passes on affected stages.
+- `fix-lockfile-chain.sh` — fixes CI steps on stages missing `package-lock.json`.
+- `fix-pin-prs.sh` — maps PR numbers to branch names for the transplant chain.
+- `fix-readfile-chain.sh` — removes an unused `readFile` import from
+  `scripts/verify-package.mjs`.
+- `fix-sha-chain.sh` — fixes truncated `actions/upload-artifact` SHA pins in
+  `ci.yml` / `supply-chain.yml`.
+- `push-remediation.sh`, `push-transplants.sh` — push remediation/transplant
+  branches to their live PR head branches.
+- `s4036-fix.sh` — fixes SonarCloud rule `javascript:S4036` in
+  `scripts/verify-package.mjs`.
+- `sonar-fix.sh` — applies SonarCloud remediation per PR branch.
+- `transplant.sh` — rebuilds the canonical transplant-commit chain onto `main`.
+- `push-results.txt` — recorded outcome of one push run (mixed
+  success/failure across PR branches).
+
+Relocated from the repository root (2026-07-28) per the L9 repository
+instantiation audit and remediation plan: these files had no consumer in
+`package.json`, GitHub Actions workflows, or documentation, and their
+presence at root implied they were part of the shipped project surface.
+They are retained here, out of the package root, pending confirmation that
+all referenced pull requests are merged or closed, at which point they can
+be deleted.