ci(hypatia-scan): repin orphan reusable SHA — finish #140's intent (#163)

## Summary

PR #140 ("repin orphan reusable SHAs (97df7621/4fdf4314 → live)") was
filed to repin **both** `rust-ci.yml` and `hypatia-scan.yml` away from
orphan pins, per its description:

> - `hypatia-scan-reusable.yml@97df7621` →
`@915139d73560e65a8240b8fc7768698658502c89`
> - `rust-ci-reusable.yml@4fdf4314` →
`@cc5a372af1af1b202c17f1b21efd954e6c038bef`

…but the merged diff only touched `rust-ci.yml`. `hypatia-scan.yml`
line 28 was never updated.

**Result**: the Hypatia Security Scan workflow has been completing as
`failure` with **zero jobs** on every push to `main` since #140
merged — `workflow_call` refuses orphan SHAs and emits "workflow file
issue" with no jobs created (exactly the pattern #140's description
named).

## Verification

```
git merge-base --is-ancestor 97df7621... origin/main → NOT ancestor (orphan)
git merge-base --is-ancestor 915139d7... origin/main → ancestor (behind by 56)
```

## Why this PR exists separately

It applies the SECOND half of #140's stated fix, no other changes.
The first half (rust-ci.yml) shipped in #140 and is working as
intended (`cc5a372` confirmed as ancestor of `standards/main`).

Refs #140.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/hypatia-scan.yml

@@ -25,5 +25,5 @@ permissions:
 
 jobs:
   hypatia:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@97df762107501909f50bb770e9bc200b6c415600
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@915139d73560e65a8240b8fc7768698658502c89
     secrets: inherit