docs: pin the GitHub Action at v2.1.1

[refeed]

Every snippet showing the GitHub Action pinned @v2, which installs py-tirith 1.2.0. Two
releases have shipped since.

Why it matters that this is manual

The action pins its CLI to an exact tag on purpose — one action ref means one known CLI, so a
caller's green pipeline cannot turn red with nothing in their repository changing. The cost is that
@v2 never drifts: anyone copying our snippets stays on 1.2.0 until we move the docs deliberately.

@v2.1.1 installs 1.2.1, whose comment renders the planned changes as a diff block above the
findings table — one row per changing resource with the attributes that move underneath it, from the
masked plan. v2.1.0
shipped that for the platform path and v2.1.1
added the local-mode path it had missed, so v2.1.1 is the first tag where the feature is true in
both modes.

The diff

Ten references, one substitution, nothing else:

file	refs
README.md	1
documentation/src/pages/index.js — the landing page	1
documentation/src/data/demoPhases.js	5
documentation/docs/tirith-usage/ci-integration.md	1
.cursor/rules/tirith-policies.mdc, .claude/skills/tirith-policies/reference/pipelines.md	2

The two agent-facing packs are included because leaving them behind hands an agent a stale pin, which
is the copy most likely to be followed without checking.

static/llms-full.txt and static/docs/ are regenerated with
documentation/scripts/generate-llms-full.py, not hand-edited — that script exists precisely so
those files are not a second source of truth. Their only change is the same version line.

Every changed line in the whole PR:

-  - uses: StackGuardian/tirith-iac-governance-action@v2
+  - uses: StackGuardian/[email protected]

Two things I found and deliberately left alone

Both belong in their own change rather than smuggled into a version bump:

• The GitLab snippet in README.md and ci-integration.md installs
  [email protected] — five releases stale.
• Both files state "There is no GitLab-native equivalent of the action", which stopped being true
  when the GitLab CI/CD component was published to the catalog.

Noted in #373 so they are not lost.

Closes #373

[sonarqubecloud]

❌ The last analysis has failed.

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.