docs(charter): code_scanning ruleset-tool-mismatch = flagship v0.1 squabbler move (#10)

Adds the CodeQL-vs-Hypatia/Scorecard `code_scanning` ruleset deadlock to
the v0.1 fight playbook as the **flagship** move.

## Why
A branch ruleset's `code_scanning` rule lists a tool in
`code_scanning_tools` that never uploads a per-PR SARIF analysis
(Hypatia = gated via a status-check context, not a code-scanning upload;
Scorecard = uploads 0 analyses estate-wide). The rule then waits
forever, so every PR sticks on "Waiting for code scanning results from
<tool> …". A permanent deadlock, not a transient failure.

## Why it's the flagship
- **Confirmed + recurring in production** the week of 2026-06-30 —
deadlocked PRs on `rsr-template-repo`, `standards`,
`odds-and-sods-package-manager`, and others.
- **Fully mechanical fix** with a verifiable satisfaction condition:
trim `code_scanning_tools` to only tools that upload SARIF per PR
(`CodeQL`); gate the rest via `required_status_checks` contexts.
- Already diagnosed/remediated on hypatia itself — see hypatia #470 and
#473. Canonical provisioner
`git-scripts/scripts/branch-protection-apply.sh` is now CodeQL-only, but
stale live `Base` rulesets persist.

Docs-only change to `docs/CHARTER.adoc`. No code/scaffold changes.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

Author: hyperpolymath

docs/CHARTER.adoc

@@ -90,6 +90,24 @@ run). All moves *satisfy* the gate, never bypass it.
 . *Reusable-workflow pin drift* → re-pin stale/broken SHA to current.
 . *Modify/delete & rebase conflicts* → resolve, re-run.
 . *Check-name ground-truthing* → shared substrate for moves 1 and 2.
+. *Unsatisfiable `code_scanning` ruleset rule* (**flagship v0.1 move**) → a branch
+  ruleset's `code_scanning` rule lists a tool in `code_scanning_tools` that never
+  uploads a per-PR-merge-commit SARIF analysis for the repo — e.g. `Hypatia`
+  (gated via a status-check context, not a code-scanning upload) or `Scorecard`
+  (uploads 0 analyses estate-wide). The rule then waits forever on an analysis
+  result that never arrives, so every PR sticks on "Waiting for code scanning
+  results from <tool> for the commit …". Fully mechanical fix: trim
+  `code_scanning_tools` down to only tools that genuinely upload SARIF per PR
+  (`CodeQL`), and gate the others via `required_status_checks` contexts instead.
++
+NOTE: This is a *confirmed, recurring, production* class — it deadlocked PRs on
+multiple estate repos the week of 2026-06-30 (`rsr-template-repo`, `standards`,
+`odds-and-sods-package-manager`, …). Already diagnosed and remediated on hypatia
+itself (see hypatia issues #470 and #473); the canonical provisioner
+`git-scripts/scripts/branch-protection-apply.sh` is now CodeQL-only, but stale
+live `Base` rulesets persist. Because the fix is purely list-trimming with a
+verifiable satisfaction condition, it is the ideal *first* squabbler move once
+the tool exists.
 
 == Outcome contract