one dependency pinned, the rest inherited

Only FAF is pinned directly. Mathlib and Foundation arrive transitively through it. Pinning all three independently would let this repository and FAF disagree about Mathlib, which is the failure mode the single pin removes.