fix(rules): eliminate four code-scanning false-positives (closes #524)

[hyperpolymath]

Fixes the four code-scanning rule false-positives documented in #524, verified end-to-end: built the escript, scanned rsr-template-repo main, and drove its open Hypatia code-scanning alerts from 48 → 0 (a clean 0-result analysis was uploaded under the hypatia category, auto-closing the stale alerts). Every one was a rule bug — the repo already satisfied the intent.

Fixes

1. cicd_rules.has_file? — recognise community-health files (SECURITY.md, …) in .github/ and docs/, not just root (GitHub treats all three as canonical). Killed the missing_requirement FP.
2. root_hygiene.scan_required_missing — remove SECURITY.md from the root-only required list; it's owned location-aware by cicd_rules. Removes a double-report + .github/-location FP.
3. scorecard_ingestor.check_sast — aggregate across all CodeQL-mentioning workflows instead of Enum.find-ing the first (e.g. workflow-linter.yml mentions "codeql" in a comment but has no matrix, masking codeql.yml's language: actions). Killed the spurious "nominal-only SAST".
4. workflow_audit WF017 — accept the valid env+output cross-step secret gate (if: steps.<id>.outputs.<name> + a step writing $GITHUB_OUTPUT). The secrets context isn't available in step-level if:, so the previously-required if: secrets.X != '' form is itself unusable.

Not changed (already resolved on main)

The .hypatia-ignore-not-wired-into-scan structural gap from #524 is already fixed on main (ScannerSuppression is applied in the scan path). The SD013 / DependencyPinning / shell_download_then_run / scorecard_wrapper FPs from the original report no longer reproduce on current main.

Closes #524.

[github-actions]

🔍 Hypatia Security Scan

Findings: 42 issues detected

Severity	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	42

View findings

[
  {
    "reason": "Repository has 5 non-main remote branch(es). Policy: single main branch only.",
    "type": "GS007",
    "file": ".",
    "action": "delete_remote_branches",
    "rule_module": "git_state",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 20 day(s) old",
    "type": "CSA001",
    "file": "src/ui/gossamer/README.adoc",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 20 day(s) old",
    "type": "CSA001",
    "file": "scripts/ci-tools/Cargo.toml",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 20 day(s) old",
    "type": "CSA001",
    "file": "scripts/bench-tools/Cargo.toml",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 20 day(s) old",
    "type": "CSA001",
    "file": "ffi/zig/README.adoc",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 20 day(s) old",
    "type": "CSA001",
    "file": "docs/reports/audit/audit-2026-04-15-post.md",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 20 day(s) old",
    "type": "CSA001",
    "file": "docs/integration/github-registry.adoc",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 20 day(s) old",
    "type": "CSA001",
    "file": "docs/integration/github-registry.adoc",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 20 day(s) old",
    "type": "CSA001",
    "file": "docs/integration/a2ml-k9.md",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 20 day(s) old",
    "type": "CSA001",
    "file": "docs/architecture/system-integration.md",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence