fix(ci): fix stale codeql-action SHA and hypatia-scan working directory

- Update github/codeql-action/upload-sarif to current v3 SHA
- Fix hypatia-scan.yml: env.HOME not available in working-directory
  context, use GITHUB_WORKSPACE relative path instead
- Fix hypatia build: mix project is at root, not scanner/ subdir

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/hypatia-scan.yml

@@ -33,19 +33,20 @@ jobs:
 
       - name: Clone Hypatia
         run: |
-          if [ ! -d "$HOME/hypatia" ]; then
-            git clone https://github.com/hyperpolymath/hypatia.git "$HOME/hypatia"
+          HYPATIA_DIR="${GITHUB_WORKSPACE}/../hypatia"
+          if [ ! -d "$HYPATIA_DIR" ]; then
+            git clone --depth 1 https://github.com/hyperpolymath/hypatia.git "$HYPATIA_DIR"
           fi
+          echo "HYPATIA_DIR=$HYPATIA_DIR" >> "$GITHUB_ENV"
 
       - name: Build Hypatia scanner (if needed)
-        working-directory: ${{ env.HOME }}/hypatia
         run: |
+          cd "$HYPATIA_DIR"
           if [ ! -f hypatia-v2 ]; then
             echo "Building hypatia-v2 scanner..."
-            cd scanner
-            mix deps.get
+            mix deps.get --quiet
             mix escript.build
-            mv hypatia ../hypatia-v2
+            mv hypatia hypatia-v2
           fi
 
       - name: Run Hypatia scan
@@ -54,7 +55,7 @@ jobs:
           echo "Scanning repository: ${{ github.repository }}"
 
           # Run scanner
-          HYPATIA_FORMAT=json "$HOME/hypatia/hypatia-cli.sh" scan . > hypatia-findings.json
+          HYPATIA_FORMAT=json "$HYPATIA_DIR/hypatia-cli.sh" scan . > hypatia-findings.json
 
           # Count findings
           FINDING_COUNT=$(jq '. | length' hypatia-findings.json 2>/dev/null || echo 0)

.github/workflows/scorecard.yml

@@ -17,7 +17,7 @@ jobs:
       security-events: write
       id-token: write
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
 
@@ -28,6 +28,6 @@ jobs:
           results_format: sarif
 
       - name: Upload results
-        uses: github/codeql-action/upload-sarif@4dd1439054423ad07501db44cf2fd84746f8ca8e # v3.31.8
+        uses: github/codeql-action/upload-sarif@ebcb5b36ded6beda4ceefea6a8bc4cc885255bb3 # v3
         with:
           sarif_file: results.sarif