fix(ci): move the scanner pin to hypatia main 23dc74d

[hyperpolymath]

Summary

This is the last step of the baseline-gate stack. governance.yml and hypatia-scan.yml pass hypatia-ref: aa34a4c (#940), which predates the rule fixes that clear this repo's own false positives. This PR moves both to hypatia main at 23dc74d, which contains:

• fix(actions-lock): support the v0.0.3 per-dependency hostname field #938: ActionsLock accepts v0.0.3 locks (already in aa34a4c);
• fix(rules): judge WH013 per job, and skip writes made with their own credential #942: WH013 judges writes per job and skips PAT/app-token writes. This clears estate-rescan.yml; inbox-steward-intake.yml was also repaired in fix(ci): inbox-steward-intake publishes through PRs and fails loudly #943;
• fix(rules): close four gaps Codex found in #942 after it merged #947: RE005 skips trap handlers, and job extraction survives comments between jobs.

uses: refs are unchanged, so actions.lock is untouched.

What this PR's governance run will show

This PR's own governance / Validate Hypatia Baseline run is the measurement: it builds the scanner at 23dc74d. The jump from aa34a4c also brings #931's new rules (WF026, WF027, PIN-003), which haven't been measured on this repo yet. hex.pm is blocked in my session, so I can't build the escript to pre-run them.

Expected remaining findings, by class:

• RE001 (harden-runner): most of the original 18 jobs, including the 2 dispatched label workflows, which must stay action-free.
  • These need an owner decision; the harden-runner steps were removed again in fix(ci): drop harden-runner until actions.lock records it #948 because the lock has no record.
• WH013, RE004, RE005, invalid_actions_lock: expected 0.

I'll post the measured list here once the run completes.

Type of change

• 🔧 Build / CI / tooling

How has this been verified?

• actionlint 1.7.7 is clean on both files.
• 23dc74d is origin/main at the time of writing. git log aa34a4c..23dc74d contains fix(rules): judge WH013 per job, and skip writes made with their own credential #942, fix(rules): close four gaps Codex found in #942 after it merged #947, fix(ci): pin test service and job containers by digest (RE004) #945, feat(rules): detect the three workflow-pin defect classes behind the estate's dead Rust CI #931, test(actions-lock): closure contract corpus shared with standards #941 and Claude/new session th4e9w lockregen #936.

Checklist

• My commits are signed. The session's signing shim is platform-mediated.
• I ran the project's own checks/tests locally and they pass.
• New files carry the correct SPDX (none added).
• Docs are updated (the pin comment names what it carries).
• I have not introduced a soundness hole.

---

Generated by Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 7 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: fa0e27ef-0870-4a11-a73a-1ece5347e75a

📥 Commits

Reviewing files that changed from the base of the PR and between 0a44921 and 9f0937d.

📒 Files selected for processing: 2

• .github/workflows/governance.yml
• .github/workflows/hypatia-scan.yml

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T14:47:34.457731Z	9f0937d	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.