ci-templates-v2026.09.30 design-drift, parser-parity: CORE_PIN_FILE / CORE_PIN_KIND read the Core ref from the consumer's own pin through scripts/core-pins.py, so the checks run against the Core the app ships (ADR-026 amendment, #434). security: semgrep gets 30 s per rule and file; the severity gate still blocks any timeout (#426).