Integration still fetched Core at PR #92's head (5e9433d): the right
pin while that PR was in review, but it predates #94 (display
credential renewal) and #93 (the registry move), both in v0.2.5. Signage
now proves itself against the release it will run on.
The pin contract also accepts a release tag (refs/tags/vX.Y.Z) alongside
a pull request head or main, and the fetch compares the ref's commit
(^{commit}) so an annotated tag pins the same way a lightweight one
does. v0.2.5 is lightweight; that should not be a hidden requirement.
Co-Authored-By: Claude Opus 5.5 <[email protected]>