chore(docs,ci): clear genuine Hypatia findings — stale src/abi paths, setup.sh, .envrc (#27)

Addresses the actionable subset of the Hypatia advisory findings surfaced by the
scanner upgrade in #26. The remaining ~7 are scanner false-positives (WF017 two-step
gate, SC-013 comment stripping, SC-014 codeql substring) for an upstream fix.

Docs (structural_drift SD022 x6 — stale path after #20's FFI removal):
- correct `src/abi/` -> the real RSR slot `src/interface/abi/` in AI-CONVENTIONS,
  RSR_OUTLINE, QUICKSTART-DEV, MAINTENANCE-CHECKLIST, INTENT.contractile
- replace the unfilled-template docs/developer/ABI-FFI-README.adoc (it still carried
  a `{{project}}` placeholder and a template-instruction line and described a
  non-existent FFI surface) with an honest "no FFI surface" stub pointing at the RSR
  placeholders and PROOF-NEEDS.md

setup.sh (code_safety shell_download_then_run / CWE-494):
- replace `curl ... just.systems/install.sh | bash` with a download-then-run helper
  (no pipe-to-shell), with opt-in JUST_VERSION pin and JUST_INSTALL_SHA256 verify;
  native package managers (incl. nix/guix) are still tried first
- update the header usage example to the download-then-run form

.envrc (secret_detected "Generic API key" — false-positive, commented placeholder):
- remove the residual `# export DATABASE_URL=...` / `# export API_KEY=...` lines
  (re-lands the fix intended in #25 that never reached main)

This does not by itself turn the hypatia check green — that needs the upstream
reusable to restore `--exit-zero`/`|| true` on the scan step so it follows its
documented advisory ("warn but don't fail") policy.


Claude-Session: https://claude.ai/code/session_01UCnxjXkN6uDj9YSANuGEgR

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.envrc

@@ -20,8 +20,6 @@ fi
 # Project environment variables
 export PROJECT_NAME="gv-clade-index"
 export RSR_TIER="infrastructure"
-# export DATABASE_URL="..."
-# export API_KEY="..."
 
 # Source .env if it exists (gitignored)
 dotenv_if_exists

.machine_readable/INTENT.contractile

@@ -58,7 +58,7 @@
   ; === Sensitive Areas (if in doubt, ask) ===
   (ask-before-touching
     ; *REMINDER: List areas where LLMs should check before modifying*
-    ; "src/abi/ — formal proofs, changes require re-verification"
+    ; "src/interface/abi/ — formal proofs, changes require re-verification"
     ; "ffi/zig/ — C ABI boundary, changes affect all language bindings"
     ; ".machine_readable/ — checkpoint files, format is specified"
   )

QUICKSTART-DEV.adoc

@@ -54,7 +54,7 @@ cd worker && npm test
 ----
 gv-clade-index/
 ├── src/                  # Source code
-├── src/abi/              # Idris2 ABI definitions (if applicable)
+├── src/interface/abi/    # Idris2 ABI definitions (if applicable)
 ├── ffi/zig/              # Zig FFI bridge (if applicable)
 ├── tests/                # Test suite
 ├── docs/                 # Documentation

docs/RSR_OUTLINE.adoc

@@ -101,7 +101,7 @@ just validate-rsr
 |`AI.a2ml`
 |Claude-specific instructions
 
-|`src/abi/`
+|`src/interface/abi/`
 |Idris2 ABI definitions (Types, Layout, Foreign)
 
 |`ffi/zig/`
@@ -177,7 +177,7 @@ project/
 │   ├── TOPOLOGY-GUIDE.adoc
 │   ├── generated/
 │   └── man/
-├── src/abi/                   # Idris2 ABI definitions
+├── src/interface/abi/         # Idris2 ABI definitions
 │   ├── Types.idr
 │   ├── Layout.idr
 │   └── Foreign.idr