fix: integrate third-party excludes in remaining 5 fix scripts

Add shared third-party-excludes.sh sourcing to fix-deno-permissions,
fix-dependabot, fix-heredoc-install, fix-unpinned-actions, and
fix-unwrap-to-match. Also gitignore shared-context/findings/ and
.hypatia/ (runtime outputs).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Jonathan D.A. Jewell

.gitignore

@@ -34,3 +34,9 @@ logs/
 
 # Generated enrollment registry
 shared-context/enrollment/repos.json
+
+# Runtime findings output
+shared-context/findings/
+
+# Hypatia scan cache
+.hypatia/

scripts/fix-deno-permissions.sh

@@ -16,6 +16,9 @@
 
 set -euo pipefail
 
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "$SCRIPT_DIR/lib/third-party-excludes.sh" 2>/dev/null || true
+
 REPO_PATH="${1:?Usage: fix-deno-permissions.sh <repo-path> <finding-json>}"
 FINDING_JSON="${2:?Usage: fix-deno-permissions.sh <repo-path> <finding-json>}"
 
@@ -48,10 +51,8 @@ while IFS= read -r -d '' script_file; do
     echo "[fix-deno-permissions] Fixed (short form): ${script_file}"
     MODIFIED=$((MODIFIED + 1))
   fi
-done < <(find "${REPO_PATH}" \
-  -path "${REPO_PATH}/.git" -prune -o \
-  -path "${REPO_PATH}/node_modules" -prune -o \
-  -name '*.sh' -type f -print0 2>/dev/null)
+done < <(find "${REPO_PATH}" -name '*.sh' -type f \
+  -not -path "*/.git/*" "${FIND_THIRD_PARTY_EXCLUDES[@]}" -print0 2>/dev/null)
 
 # --- Fix justfile and Makefile ---
 for build_file in "${REPO_PATH}/justfile" "${REPO_PATH}/Justfile" \
@@ -76,11 +77,10 @@ while IFS= read -r -d '' nested_config; do
     MODIFIED=$((MODIFIED + 1))
   fi
 done < <(find "${REPO_PATH}" \
-  -path "${REPO_PATH}/.git" -prune -o \
-  -path "${REPO_PATH}/node_modules" -prune -o \
   \( -name 'deno.json' -o -name 'deno.jsonc' \) \
   -not -path "${REPO_PATH}/deno.json" \
   -not -path "${REPO_PATH}/deno.jsonc" \
+  -not -path "*/.git/*" "${FIND_THIRD_PARTY_EXCLUDES[@]}" \
   -type f -print0 2>/dev/null)
 
 if [[ ${MODIFIED} -eq 0 ]]; then

scripts/fix-dependabot.sh

@@ -11,6 +11,9 @@
 
 set -euo pipefail
 
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "$SCRIPT_DIR/lib/third-party-excludes.sh" 2>/dev/null || true
+
 REPO_PATH="${1:?Usage: fix-dependabot.sh <repo-path> <finding-json>}"
 FINDING_JSON="${2:?Usage: fix-dependabot.sh <repo-path> <finding-json>}"
 

scripts/fix-heredoc-install.sh

@@ -10,6 +10,9 @@
 
 set -euo pipefail
 
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "$SCRIPT_DIR/lib/third-party-excludes.sh" 2>/dev/null || true
+
 REPO_PATH="${1:?Usage: $0 <repo-path> <finding-json>}"
 FINDING_JSON="${2:?Missing finding JSON file}"
 
@@ -48,7 +51,7 @@ while IFS= read -r -d '' file; do
     if [[ "$changes" -gt 0 ]]; then
         ((FIXED_COUNT++)) || true
     fi
-done < <(find "$REPO_PATH" -type f \( -name "*.sh" -o -name "*.bash" \) -not -path "*/\.git/*" -not -path "*/target/*" -print0 2>/dev/null)
+done < <(find "$REPO_PATH" -type f \( -name "*.sh" -o -name "*.bash" \) -not -path "*/.git/*" "${FIND_THIRD_PARTY_EXCLUDES[@]}" -print0 2>/dev/null)
 
 echo ""
 if [[ "$FIXED_COUNT" -gt 0 ]]; then

scripts/fix-unpinned-actions.sh

@@ -4,6 +4,9 @@
 
 set -euo pipefail
 
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "$SCRIPT_DIR/lib/third-party-excludes.sh" 2>/dev/null || true
+
 REPO_PATH="$1"
 FINDING_FILE="$2"
 

scripts/fix-unwrap-to-match.sh

@@ -17,6 +17,9 @@
 
 set -euo pipefail
 
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "$SCRIPT_DIR/lib/third-party-excludes.sh" 2>/dev/null || true
+
 REPO_PATH="${1:?Usage: $0 <repo-path> <finding-json>}"
 FINDING_JSON="${2:?Missing finding JSON file}"
 
@@ -89,8 +92,7 @@ while IFS= read -r -d '' file; do
     ((TOTAL_REPLACEMENTS += count)) || true
 
 done < <(find "$REPO_PATH" -type f -name "*.rs" \
-    -not -path "*/\.git/*" \
-    -not -path "*/target/*" \
+    -not -path "*/.git/*" "${FIND_THIRD_PARTY_EXCLUDES[@]}" \
     -print0 2>/dev/null)
 
 echo ""