ci(hypatia): interim revert to working reusable pin (standards@5a93d9d cache pin is broken)

[hyperpolymath]

Why

After #22 bumped the Hypatia reusable pin to standards@5a93d9d, the hypatia / Hypatia Neurosymbolic Analysis check now hard-fails at startup (~3s) on main and every PR:

##[error]Unable to resolve action `actions/cache@d4373f267a887d77f9eb0683a479ec60b1fe5b2b`, unable to find version

That bad pin lives inside hyperpolymath/standards's hypatia-scan-reusable.yml@5a93d9d (labelled # v4.2.0, but the SHA doesn't resolve). It's an upstream bug, not in this repo's caller — but it breaks Hypatia scanning here.

What this does (interim)

Reverts only this repo's Hypatia caller pin to the last working SHA (915139d, which ran green on #20), so Hypatia scanning runs again. governance and scorecard stay on 5a93d9d.

Trade-off: the Check Workflow Staleness gate will flag hypatia-scan.yml as stale until standards is repinned. This swaps a broken build for a stale-pin flag — the security scan actually runs again, which is the higher-value state.

Proper fix (upstream — owner action)

In hyperpolymath/standards → .github/workflows/hypatia-scan-reusable.yml:

- uses: actions/cache@d4373f267a887d77f9eb0683a479ec60b1fe5b2b # v4.2.0
+ uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0

(1bd1e32… is the real v4.2.0 commit.) Once that lands, I'll restore this caller (and governance/scorecard) to the new standards HEAD so both the staleness gate and Hypatia are green. This PR can then be closed or superseded.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UCnxjXkN6uDj9YSANuGEgR

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 53 issues detected

Severity	Count
🔴 Critical	1
🟠 High	9
🟡 Medium	43

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in release.yml",
    "type": "missing_timeout_minutes",
    "file": "release.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in release.yml",
    "type": "missing_timeout_minutes",
    "file": "release.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in release.yml",
    "type": "missing_timeout_minutes",
    "file": "release.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in rhodibot.yml",
    "type": "missing_timeout_minutes",
    "file": "rhodibot.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in static-analysis-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "static-analysis-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in static-analysis-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "static-analysis-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in static-analysis-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "static-analysis-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in scorecard.yml",
    "type": "scorecard_wrapper_missing_job_permissions",
    "file": "scorecard.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "codeql_missing_actions_language",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence