ci: make the four required status checks reportable on every PR (#645)

## Problem

The merge box shows four **required** checks stuck at *"Expected —
Waiting for status to be reported"*. This push confirmed it server-side:

```
- 4 of 4 required status checks are expected.
```

"Expected" is **not** a failure — it means a required context name was
*never reported on the head commit*. Each of the four is produced by a
different mechanism, and each can independently fail to report (proven
against live PRs: affinescript #626, hypatia #517, gitbot-fleet #307):

| Required context | Producer | Why it can sit "Expected" |
|---|---|---|
| `analyze (actions, none)` | `codeql.yml` job `analyze` |
`pull_request:` was gated to `branches:[main,master]` → no run on other
bases → check never created |
| `hypatia / Hypatia Neurosymbolic Analysis` | `hypatia-scan.yml`
reusable caller `hypatia` | same branch gate |
| `Hypatia` | Hypatia **GitHub App** check | external; rides on the scan
— absent on PRs where the scan didn't run (e.g. gitbot-fleet #307) |
| `governance / Validate Hypatia baseline` | the **`standards`
governance reusable** (job `governance` / "Validate Hypatia baseline") |
this repo migrated off that reusable to a standalone `governance` job
(#603/#604), which emits the context **`governance`** instead — so the
pinned name is **orphaned and can never report** |

Root cause (one line): **branch protection pins context strings that
this repo only *conditionally* emits** — a renamed job, branch-filtered
workflows, and an external app — and GitHub renders any
required-but-unproduced context as a permanent "Expected",
indistinguishable from a hang.

## What this PR changes (repo-side fix)

1. **`codeql.yml`** — drop `pull_request: branches:[main,master]`. The
required `analyze (actions, none)` job now runs on PRs against **every**
base. (`push:` unchanged.)
2. **`hypatia-scan.yml`** — same de-gate, so `hypatia / Hypatia
Neurosymbolic Analysis` runs on every PR base (and the `Hypatia` app
check rides along).
3. **`governance-baseline.yml` + `governance-baseline-impl.yml`** (new)
— a **local reusable** whose caller job id `governance` + reusable job
`Validate Hypatia baseline` re-emit the exact pinned context `governance
/ Validate Hypatia baseline`, on every PR. It is:
- **additive** — the standalone `governance.yml` gate is untouched; the
repo now emits both `governance` and `governance / Validate Hypatia
baseline`;
- **safe vs. the reasons #603/#604 left the reusable** — it's *local*
(no `@main` cross-repo coupling) and declares **no** `concurrency:` in
the reusable (avoids the BP008 startup-failure class);
- **a real gate** — validates `.hypatia-baseline.json` with `jq` (no
npm) when present; passes with a notice when absent (this repo's current
state).

## Residuals that need branch-protection admin (cannot be done from repo
files)

- **`Hypatia` app check**: de-gating the scan is the best repo-side
lever, but the app posting is ultimately external. If it still shows
"Expected" on some PRs, either make it post unconditionally or
**de-require** it.
- **Pin reconciliation (the cleaner fix)**: the truly correct change is
to repoint the pins to the names this repo actually emits — `governance
/ Validate Hypatia baseline` → `governance`, and confirm no *other*
`governance / *` sub-checks (the reusable emits 8) are still pinned from
the pre-#603/#604 era. The local-reusable bridge here exists only so the
box can go green **without** that admin access; if you'd rather repoint
the pin, this bridge can be dropped.

## Verification

This PR's own run should now report all four contexts instead of leaving
them "Expected"; `governance / Validate Hypatia baseline` is
self-demonstrating (the new workflow runs on this PR). I'll confirm from
the check-runs once they land.

## Estate note

`codeql.yml` / `hypatia-scan.yml` carry the identical
`branches:[main,master]` PR gate in `hypatia`, `gitbot-fleet`, and
`.git-private-farm`; the same de-gate applies there. The `governance`
divergence is **affinescript-only** — the other three still call the
reusable and emit `governance / Validate Hypatia baseline` natively.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01UXXpaoiATzxcn3kW3eTM26

---
_Generated by [Claude
Code](https://claude.ai/code/session_01UXXpaoiATzxcn3kW3eTM26)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/codeql.yml

@@ -3,8 +3,11 @@ name: CodeQL Security Analysis
 on:
   push:
     branches: [main, master]
+  # No `branches:` filter: this job emits the required check
+  # `analyze (actions, none)`, so it must run on PRs against EVERY base —
+  # a required check whose workflow is filtered out is never created and
+  # sits forever at "Expected — Waiting for status to be reported".
   pull_request:
-    branches: [main, master]
   schedule:
     - cron: '0 6 1 * *'
 # Estate guardrail: cancel superseded runs so re-pushes / rebased PR

.github/workflows/governance-baseline-impl.yml

@@ -0,0 +1,50 @@
+# SPDX-License-Identifier: MPL-2.0
+#
+# Local reusable backing `governance-baseline.yml`. Its single job is named
+# "Validate Hypatia baseline" so that, when called from a job with id
+# `governance`, GitHub reports the check context
+# `governance / Validate Hypatia baseline` — the estate-standard name pinned by
+# branch protection.
+#
+# It is a genuine (if lightweight) gate: when a `.hypatia-baseline.json` is
+# present it must be well-formed JSON, and any baseline entry that points at a
+# now-absent file is surfaced as a warning. With no baseline file present
+# (this repo's preferred state) it passes with a notice. Uses `jq` only — no
+# npm (npm is banned in this repo; `jq` ships on the runner).
+#
+# Deliberately declares NO `concurrency:` — see the BP008 note in the caller.
+name: Governance Baseline (impl)
+on:
+  workflow_call:
+permissions:
+  contents: read
+jobs:
+  validate:
+    name: Validate Hypatia baseline
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Validate .hypatia-baseline.json (if present)
+        run: |
+          set -euo pipefail
+          if [ ! -f .hypatia-baseline.json ]; then
+            echo "::notice::No .hypatia-baseline.json present — nothing to validate."
+            exit 0
+          fi
+          echo "Found .hypatia-baseline.json — verifying it is well-formed JSON."
+          if ! jq empty .hypatia-baseline.json; then
+            echo "::error file=.hypatia-baseline.json::.hypatia-baseline.json is not valid JSON."
+            exit 1
+          fi
+          echo "Scanning for stale baseline entries (referenced files that no longer exist)."
+          stale=0
+          while IFS= read -r f; do
+            if [ -n "$f" ] && [ ! -e "$f" ]; then
+              echo "::warning file=.hypatia-baseline.json::Stale baseline entry: $f no longer exists."
+              stale=$((stale + 1))
+            fi
+          done < <(jq -r '.. | objects | .file? // empty' .hypatia-baseline.json 2>/dev/null || true)
+          echo "Stale entries: ${stale} (warnings only, non-blocking)."
+          echo "Baseline validation passed."

.github/workflows/governance-baseline.yml

@@ -0,0 +1,47 @@
+# SPDX-License-Identifier: MPL-2.0
+#
+# Required-check bridge: re-emits the estate-standard governance check context
+# `governance / Validate Hypatia baseline` on EVERY pull request.
+#
+# Why this exists
+# ---------------
+# Branch protection pins `governance / Validate Hypatia baseline` as a required
+# status check. That exact context name is produced by the shared
+# `hyperpolymath/standards` governance *reusable* — the check name of a
+# reusable job is `<caller-job-id> / <reusable-job-name>`, i.e.
+# `governance` + "Validate Hypatia baseline".
+#
+# This repo migrated its governance gate OFF that reusable to a standalone job
+# (`governance.yml` -> tools/ci/governance-standalone.sh, #603/#604) to escape
+# the cross-repo `@main` coupling and the BP008 reusable-caller startup
+# failure. The standalone job emits the context `governance` instead, so the
+# pinned `governance / Validate Hypatia baseline` was never reported again and
+# sat permanently at "Expected — Waiting for status to be reported".
+#
+# This workflow reproduces JUST that context name through a *local* reusable
+# (no cross-repo coupling, so none of the BP008 risk that motivated #603/#604),
+# leaving the standalone `governance.yml` gate untouched. It is additive: the
+# repo now emits both `governance` and `governance / Validate Hypatia baseline`.
+#
+# The cleaner long-term fix is to repoint the branch-protection pin to the
+# emitted name (`governance`); this bridge makes the merge box go green without
+# requiring repo-admin access to edit branch protection.
+name: Governance Baseline
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+  workflow_dispatch:
+# Caller-side concurrency only. The local reusable deliberately declares NO
+# concurrency block: a reusable that declares concurrency on the same computed
+# key as its caller is rejected at run-creation (the BP008 class).
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+jobs:
+  # Job id MUST be `governance` so the reusable's job surfaces as the required
+  # context `governance / Validate Hypatia baseline`.
+  governance:
+    uses: ./.github/workflows/governance-baseline-impl.yml

.github/workflows/hypatia-scan.yml

@@ -6,8 +6,12 @@ name: Hypatia Security Scan
 on:
   push:
     branches: [main, master, develop]
+  # No `branches:` filter: this job emits the required check
+  # `hypatia / Hypatia Neurosymbolic Analysis` (and drives the `Hypatia`
+  # app check), so it must run on PRs against EVERY base. A required check
+  # whose workflow is branch-filtered is never created and sits forever at
+  # "Expected — Waiting for status to be reported".
   pull_request:
-    branches: [main, master]
   schedule:
     - cron: '0 0 * * 0'
   workflow_dispatch: