ci(governance): replace inert Hypatia baseline with .hypatia-ignore (#43)

#42's .hypatia-baseline.json did not suppress anything. `hypatia scan`
only lists the baseline FILE in ScannerSuppression's @universal_excludes
(so the file itself is not scanned for secrets) — it never applies the
baseline to filter findings. That post-filter (standards' apply-baseline.sh)
is run by neither the advisory scan nor the governance "Validate Hypatia
Baseline" gate, so adding the baseline only activated that gate (which then
counted all 13 tokenless findings and failed) without silencing the two
"critical" false-positive secret detections.

Replace it with .hypatia-ignore — the mechanism hypatia scan actually
honours (Hypatia.ScannerSuppression.suppressed?, consulted by both the
code_safety path and the secret-detection path in cli.ex). Scoped per
rule_module/rule_type to the seven reviewed file-based false positives
(two test-fixture "secrets", three escaped-markup innerHTML sinks, the
loopback HTTP URL, the syscall @bitcast), each with a rationale comment.

Effect: the false positives (both criticals included) are suppressed in
every hypatia scan, clearing the advisory "Action Required" banner; and
removing the baseline returns "Validate Hypatia Baseline" to skipped
(green). Matching verified against the scanner source by re-implementing
parse_user_exemptions + match_exemptions? over the actual file: all seven
match, with negative controls correctly left un-suppressed.


Claude-Session: https://claude.ai/code/session_01LvsZgNxFbeqfRmrVFNhJ8G

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.hypatia-baseline.json

@@ -0,0 +1,39 @@
+# .hypatia-ignore — scoped suppressions for reviewed Hypatia false positives.
+#
+# Format (one per line; `#` starts a comment):
+#   <rule_module>/<rule_type>:<repo-relative-path-fragment>
+# The path is matched as a substring of the finding's repo-relative path
+# (Hypatia.ScannerSuppression). Each entry below is a documented false
+# positive — see the PR that added this file for the full rationale.
+#
+# NOTE: this is the mechanism `hypatia scan` actually honours. `.hypatia-baseline.json`
+# is only applied by the external apply-baseline.sh post-filter, which this
+# estate's CI does not run, so it does not suppress anything here.
+
+# --- Test-fixture "secrets" (not credentials) ---------------------------------
+# gitleaks, trufflehog, rust-secrets and shell-secrets all pass clean on these.
+#   fuzz_config.zig:58 — fuzzer seed string ("PASSWORD='quoted'\nAPI_KEY=...")
+#     exercising the ENV config parser; literal test input.
+#   .envrc:24 — commented-out placeholder (# export API_KEY="..."); real
+#     secrets live in the gitignored .env loaded via dotenv_if_exists.
+security_errors/secret_detected:src/interface/ffi/src/fuzz_config.zig
+security_errors/secret_detected:.envrc
+
+# --- Escaped-markup innerHTML sinks (CWE-79 false positives) -------------------
+# All interpolated text is escaped (escapeHtml / escapeTermHtml / escapeXml)
+# and the assigned value is markup (ANSI-styled spans, SVG) that textContent
+# cannot express. The sink is intentional; the inputs are escaped.
+code_safety/js_innerhtml:src/gui/fli/fli-tooltip.js
+code_safety/js_innerhtml:src/gui/fli/fli-terminal.js
+code_safety/js_innerhtml:src/gui/fli/fli-gauge.js
+
+# --- Loopback HTTP URL (CWE-319 false positive) -------------------------------
+# http://[::1]:8090 is IPv6 loopback to a local VeriSimDB that serves plain
+# HTTP; https would break the health check. CWE-319 concerns cleartext over a
+# network — loopback is not network transit.
+code_safety/ncl_http_url:.machine_readable/svc/k9/template-hunt.k9.ncl
+
+# --- Required syscall @bitCast (CWE-704 false positive) -----------------------
+# Flips O_NONBLOCK on the std.posix.O packed struct for the fcntl syscall
+# (Zig 0.15). Behaviour-preserving; rewriting would break non-blocking connect.
+code_safety/zig_bit_cast:src/interface/ffi/src/probe.zig