ADR-0005 migration: move the remaining @main callers to v1.2.3

[cpitzi]

ADR-0005 (accepted 2026-08-16) makes immutable semver tags the only supported way to consume these reusables. A fleet audit on 2026-10-06 found 14 repos still calling at @main: 14× claude-responder, 12× claude-review, 14× docs-check and 5× shellcheck. Only repo-template, uvularia and coderabbit were pinned, all at v1.2.2.

v1.2.3 was cut from main (43b4fe4) for this migration. main was 4 commits ahead of v1.2.2 (Dependabot bumps #56 and #59), so pinning to v1.2.2 would have rolled those back.

Per-repo PRs, one each, reference this issue: asclepias, betula, brasenia, claytonia, drosera, epigaea, .github, kalmia, music-curator, osmunda, site-icecreamtofightwith-com, site-lentago-dev, site-pondviewlane-com, solidago. Those PRs also:

• add a shellcheck caller where a repo has .sh files without one;
• remove the dispatch-only claude-code-review.yml stubs, which have been disabled since 2026-06-25. CodeRabbit has been the org-wide advisory reviewer since 2026-10-03.

The already-pinned repos (coderabbit, repo-template, uvularia) bump v1.2.2 → v1.2.3.

Close when no fleet repo calls a reusable at @main.

[cpitzi]

Done 2026-10-06. A fleet sweep of all 27 non-archived lentago repos finds no lentago/shared-workflows/...@main or lentago/drosera/...@main references, and no remaining claude-code-review.yml stubs.

• Pinned to v1.2.3: asclepias#12, betula#123, brasenia#21, claytonia#133, drosera#247, epigaea#523, .github#231, kalmia#136, music-curator#91, osmunda#6, site-icecreamtofightwith-com#196, site-lentago-dev#89, site-pondviewlane-com#83, solidago#209, repo-template#22, uvularia#78, coderabbit#2.
• Remaining stubs retired with their doc references updated: music-curator#92, site-lentago-dev#90, repo-template#23 (ADR-0002 amended), uvularia#79.
• loki-event vendored into the uvularia templates (uvularia#78, synced) and the hand-synced demos (uvularia-demo-records#19, uvularia-demo-ask-rules#14).
• New shellcheck callers are now required (.github#232) on brasenia, epigaea, solidago, osmunda, site-lentago-dev, site-icecreamtofightwith-com and uvularia.

Still mixed: some repos keep tf-lint/site-deploy at @v1.2.2. That is tag-pinned, not @main; Dependabot will move them.