fix(ci): restore Hypatia baseline behavior after #1281

[hyperpolymath]

Stacks on #1281 to address its outstanding Hypatia/baseline regressions and associated CI failures.

• Restore acceptance of scanner baseline severities (warn, informational), warn/medium compatibility, list-valued rule_module membership, and accurate blocking counts.
• Preserve the empty-findings [] positive control in the scanner security self-test.
• Align the baseline validator with the authoritative schema for module arrays, optional notes, and the separate severity-override enum.
• Add regression coverage for compatibility, blocking ranks, overrides, malformed entries, and threshold diagnostics.

K9-SVC scope is unchanged; the latest PR #1281 K9 contractile check is green. Local validation: baseline regression suite (52 checks), Hypatia blocking-gate suite, shipped-baseline filter, JSON parse, and git diff --check pass.

This is deliberately based on #1281's head branch so the fixes land in the stack before #1281 is merged.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T10:51:20.582408Z	eb37721	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: e9c6b092-b8fb-40b8-b677-45a66195ea03

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🟢 conformant · commit eb37721a2d69 · run 39240066247

Category	Status	Pass	Fail	Indeterminate	N/A	Since previous revision
DEED syntax	🟢 conformant	4	0	0	0	↔ unchanged
K9 contract typecheck	🟢 conformant	1	0	0	0	↔ unchanged
K9 validator self-test	🟢 conformant	34	0	0	0	↔ unchanged
K9 positive/negative controls	🟢 conformant	27	0	0	0	↔ unchanged
K9 live corpus (L0–L2)	🟢 conformant	12	0	0	2	↔ unchanged

K9 live corpus (L0–L2): 2 finding(s) / scope notes

• 2-protocols/k9-coordination/examples/minimal.k9 — not_applicable: Routed to another dialect; not validated as a K9 contract.
• coordination.k9 — not_applicable: Routed to another dialect; not validated as a K9 contract.

Scope: DEED syntax and K9 contracts L0–L2. L3 signature verification and routed coordination dialects are not certified. Green is limited to this scope. Orange is missing evidence; grey is an explicit scope exclusion. Logs and report.json are in the dated conformance-evidence artifact on the linked run.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud