feat(ci-infra): freeze safety debt with a triple-keyed shrink-only ratchet (#1285)