PinTrace: two waves of SHA pinning in GitHub Actions (replication data and results)

Version 1.5 contains the manuscript as submitted to the Journal of Software: Evolution and Process, together with the analyses added in the final pre-submission revision. Under paper/jsep/ it holds the submitted PDF, the LaTeX source, the figure files, the bibliography, the build scripts and claim_ledger.json; the build regenerates main.tex byte for byte from the archived result files. reports/post_review.json and formal-stock-v1/ add the stock of pinned references over time, the period split of conversions, and the owner-clustered intervals. The measurement archive is unchanged from version 1.4. The record contains two archives. pintrace-measurements-v1.tar.zst holds the per-repository measurement snapshots for 457 measured repositories and 301 matched control repositories, the archived upstream release evidence and the matched-control assignments. pintrace-results-v1.tar.zst holds the published result files, the formal-statistics outputs, the 150-item gold set, the research documentation, the manuscript PDF and LaTeX source, and the claim ledger that maps every rendered number to a result file and JSON pointer. Each archive includes a SHA-256 manifest and a README with extraction and reproduction instructions. The measurement files contain repository identifiers but no commit author names, commit messages, e-mail addresses or credentials. The code is at https://github.com/JunjieChen0/PinTrace under the MIT license. Replication data and results are released under CC BY 4.0. The study has no comparison group shielded from the incident, so the reported quantities describe timing, targets and persistence rather than an incident effect.