fix(ci): bootstrap .hypatia-baseline.json — gate was legacy-mode

After the mass-deletion restore, gitbot-fleet had no .hypatia-baseline.json,
so hypatia-scan ran legacy-mode and failed on ANY critical/high finding
(127 in the restored legacy tree). This bootstraps the baseline exactly
as hypatia itself did, making the gate baseline-aware: pre-existing
findings are accepted, genuinely-new critical/high findings still fail.

Generated from the real CI scan (run 25958894642) with the gate's own
identity projection — {severity, rule_module, type, file} with runner
paths normalised — so it matches the gate byte-for-byte (verified:
simulated gate subtraction yields new_count=0). 99 unique entries.

Triage of the accepted findings (all pre-existing, none introduced
here; confirmed false positives / legacy debt, not live leaks):
  * 35 cicd_rules/banned_language_file — restored gsbot Python scripts.
  * 32 migration_rules/deprecated_api — legacy bot code.
  * 27 security_errors/secret_detected — scanner-self-match: cipherbot's
    own detection regexes + test fixtures, and commented-out
    placeholders in echidnabot.toml/.example.toml/docs. No real secret.
  * 24 code_safety/unwrap_without_check — Rust unwraps in bot code.
Fixing these at source (banned-language migration, secret-FP markers,
unwrap hardening) is tracked separately as legacy debt; baselining is
the designed bootstrap, not the end state.

Refs hyperpolymath/hypatia#252

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath