security: standardize secret scanning on TruffleHog (+ ADR-023 draft stub, zig wasm_export_call types) (#564)

Owner commit 2ceb06f pushed for preservation + CI adjudication per "what
can go main goes main".

Contents (one signed commit):
- **TruffleHog standardization** across root + affinescript-vite +
affinescriptiser workflow trees (its substance; net -393 lines).
- **docs/decisions/0023-finality-types.adoc** — ADR-023 finality-types
DRAFT stub (Status: Draft, design-only, no implementation; sequencing
constraints reference #554/#553). Rides along; ratification is a
separate act.
- **tools/wasm-export-call-zig/src/types.zig** — WasmValue 4-variant
types for the #497 Zig FFI dispatcher (WIP preservation; unwired).

If checks are green this is main-able as-is; if the mixed contents
should split, say so and I'll surgically refile.

Refs #497, #563. ADR-023 context: assured-finality dual per the
2026-06-11 design discussion.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Author: hyperpolymath

.github/workflows/affine-vscode-publish.yml

@@ -17,26 +17,21 @@
 # publish rights to the @hyperpolymath scope).
 
 name: Publish affine-vscode
-
 on:
   push:
     tags:
       - 'affine-vscode-v*'
-
 permissions:
   contents: read
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
-
 jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
       - name: Verify tag matches package version
         working-directory: packages/affine-vscode
         run: |
@@ -47,7 +42,6 @@ jobs:
             exit 1
           fi
           echo "✅ Publishing @hyperpolymath/affine-vscode@$pkg"
-
       - name: Configure npm auth
         env:
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
@@ -57,11 +51,9 @@ jobs:
             exit 1
           fi
           echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > "${HOME}/.npmrc"
-
       - name: Publish to npm
         working-directory: packages/affine-vscode
         run: npm publish --access public
-
       - name: Clean up npm auth
         if: always()
         run: rm -f "${HOME}/.npmrc"

.github/workflows/casket-pages.yml

@@ -1,20 +1,16 @@
 # SPDX-License-Identifier: MPL-2.0
 name: GitHub Pages
-
 on:
   push:
     branches: [main]
   workflow_dispatch:
-
 permissions:
   contents: read
   pages: write
   id-token: write
-
 concurrency:
   group: "pages"
   cancel-in-progress: false
-
 jobs:
   # Pages is a repo-level admin feature; a workflow's `GITHUB_TOKEN`
   # cannot enable it from CI, regardless of `pages: write` at workflow
@@ -45,27 +41,23 @@ jobs:
             echo "enabled=false" >> "$GITHUB_OUTPUT"
             echo "::notice::Pages not enabled on ${GITHUB_REPOSITORY} — skipping build/deploy. Enable via repo Settings → Pages to unblock."
           fi
-
   build:
     needs: precheck
     if: needs.precheck.outputs.enabled == 'true'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
-
       - name: Checkout casket-ssg
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
         with:
           repository: hyperpolymath/casket-ssg
           path: .casket-ssg
-
       - name: Setup GHCup
         uses: haskell-actions/setup@cd0d9bdd65b20557f41bea4dbe43d0b5fbbfe553 # v2
         with:
           ghc-version: '9.8.2'
           cabal-version: '3.10'
-
       - name: Cache Cabal
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v4
         with:
@@ -74,11 +66,9 @@ jobs:
             ~/.cabal/store
             .casket-ssg/dist-newstyle
           key: ${{ runner.os }}-casket-${{ hashFiles('.casket-ssg/casket-ssg.cabal') }}
-
       - name: Build casket-ssg
         working-directory: .casket-ssg
         run: cabal build
-
       - name: Build site
         run: |
           mkdir -p site _site
@@ -109,7 +99,6 @@ jobs:
             fi
           fi
           cd .casket-ssg && cabal run casket-ssg -- build ../site ../_site
-
       - name: Setup Pages
         uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
         with:
@@ -121,12 +110,10 @@ jobs:
           # own permissions (pages: write, id-token: write) authorise
           # this.
           enablement: true
-
       - name: Upload artifact
         uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: '_site'
-
   deploy:
     environment:
       name: github-pages