fix: Hypatia high-finding remediation, drop vacuous rust-ci, fix CLADE identity

.github/workflows/instant-sync.yml

@@ -13,7 +13,21 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
+      # Secrets are only readable in step-level env (a job-level `if:` on
+      # secrets is a parse-time startup_failure), so gate here.
+      - name: Gate on FARM_DISPATCH_TOKEN presence
+        id: gate
+        env:
+          FARM_DISPATCH_TOKEN: ${{ secrets.FARM_DISPATCH_TOKEN }}
+        run: |
+          if [ -z "$FARM_DISPATCH_TOKEN" ]; then
+            echo "::notice::FARM_DISPATCH_TOKEN not configured; skipping dispatch"
+            echo "present=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "present=true" >> "$GITHUB_OUTPUT"
+          fi
       - name: Trigger Propagation
+        if: steps.gate.outputs.present == 'true'
         uses: peter-evans/repository-dispatch@v4.0.1
         with:
           token: ${{ secrets.FARM_DISPATCH_TOKEN }}

.github/workflows/scorecard.yml

@@ -16,4 +16,11 @@ concurrency:
 
 jobs:
   scorecard:
+    # The reusable runs OSSF Scorecard, which needs these beyond the
+    # caller's top-level contents: read; a reusable requesting more
+    # permissions than its caller grants is a startup_failure.
+    permissions:
+      contents: read
+      security-events: write
+      id-token: write
     uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236

.machine_readable/6a2/CLADE.a2ml

@@ -3,11 +3,13 @@
 # See: https://github.com/hyperpolymath/gv-clade-index
 
 [identity]
+# TODO(owner): this uuid is the rsr-template's; a real haec entry must be
+# assigned from gv-clade-index — do not invent one here.
 uuid = "a5ea1382-a34c-5334-8a46-a2ebe904c810"
 primary-forge = "github"
 primary-owner = "hyperpolymath"
-canonical-name = "rsr-template-repo"
-prefixed-name = "rm-rsr-template-repo"
+canonical-name = "haec"
+prefixed-name = "rm-haec"
 
 [clade]
 primary = "rm"
@@ -16,9 +18,9 @@ assigned = "2026-03-16"
 rationale = ""
 
 [forges]
-github = "hyperpolymath/rsr-template-repo"
-gitlab = "hyperpolymath/rsr-template-repo"
-bitbucket = "hyperpolymath/rsr-template-repo"
+github = "hyperpolymath/haec"
+gitlab = "hyperpolymath/haec"
+bitbucket = "hyperpolymath/haec"
 
 [lineage]
 type = "standalone"