The pinned colleague SHA is not on colleague's main branch (fragile characterization provenance)

[OriNachum]

The problem

The characterization baseline pins colleague at
28fee290c51fc4310b9fc576981809ad5c3132c6, in three places:

• scripts/handler_hashes.py:47
• scripts/capture_colleague_baseline.py:66
• scripts/colleague_inventory.py:65

That commit is not on colleague's main. Verified during the
m1-leftovers arc:

git merge-base --is-ancestor 28fee29 origin/main   -> exit 1 (not an ancestor)
git branch -a --contains 28fee29                   -> spec/348-same-origin-key-hygiene
git rev-list --count HEAD..28fee29                 -> 12 commits main lacks

colleague's main is now at 8e130f5 (v1.52.1).

Why it is not breaking today

• The SHA is reachable from origin (git fetch origin 28fee29 succeeds),
  so CI's inventory-gate clone works and --check exits 0.
• colleague/tools.py, policy.py, media.py, hooks.py and loop.py are
  byte-identical between the pin and current main (0-byte diff), so every
  captured fixture remains valid. An independent re-verification during this arc
  confirmed every line number CLAUDE.md's survey cites still holds at v1.52.1.

Why it still matters

1. Fragile provenance. A baseline pinned to a feature-branch commit depends
   on that branch surviving. If it is deleted or the repo GC'd, the pin becomes
   unfetchable and the characterization suite cannot be regenerated at all.
2. The docs describe it inaccurately. CLAUDE.md says "colleague 1.51.0 at
   commit 28fee29" with no hint that this is not a main-line commit.
3. The local dev baseline is red by default. Three tests in
   tests/characterization/test_regeneration_reproducible.py fail on any
   checkout of colleague that is not at the pin — which is every ordinary
   developer checkout. Working around it needs
   SHELL_CLI_COLLEAGUE_ROOT pointed at a clone parked at the pin.

Options

• Re-pin to a main-line SHA. Behaviour-preserving, since the surveyed files
  are byte-identical. Regenerating is now mechanical via --emit-baseline.
• Or document the feature-branch provenance explicitly and add a
  fetchability guard that fails loudly rather than mysteriously.

Either way the three PINNED_SHA constants and SITE_BASELINE must move in one
reviewed diff, which the current design already enforces.