Apply GH-DEC-2026-021: identity-value pins, prose citations not reached.

The playbook detector is the estate reference (021 §3). Add its one
addition to the reference and the checker: any v?N.N in a standard: or
companion: value is a pin. The prose-citation note moves from pending to
not reached (021 §1, A12 r3), and intent_version is noted as a key that
must not be flagged. VALIDATED_AGAINST keeps accepted v0.7 and adds
GH-DEC-2026-021 at gate-house@39d9287.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

tests/test_layer_conformance.py

@@ -115,6 +115,21 @@ class TestDeclaration:
         assert checker.find_version_pins({"layer": "Staff", "companion_version": "0.2"})
         assert checker.find_version_pins({"nested": {"standard_version": "0.7"}})
 
+    def test_version_token_in_identity_value_is_a_pin(self):
+        """GH-DEC-2026-021 §3: any `v?N.N` in a standard:/companion: value is a pin."""
+        checker = _checker()
+        pins = checker.find_version_pins({"standard": "security-layer-model v0.7"})
+        assert pins and pins[0].startswith("standard")
+        assert checker.find_version_pins({"companion": "SECURITY-COMPANION 0.2"})
+        assert checker.find_version_pins({"nested": {"standard": ["security-layer-model v0.8"]}})
+
+    def test_prose_citation_and_intent_version_are_not_reached(self):
+        """GH-DEC-2026-021 §1 (A12 r3): prose provenance and `intent_version` pass."""
+        checker = _checker()
+        assert checker.find_version_pins(
+            {"layer": "Staff", "note": "Outside §5 by the v0.5 scope rule", "intent_version": "0.1.0"}
+        ) == []
+
     def test_schema_version_is_not_reached(self):
         assert _checker().find_version_pins({"schema_version": "0.2", "layer": "Staff"}) == []