fix(ci): unblock the now-honest static-analysis gate and the Idris2 CI job (#28)

Follow-up to #27, which merged before these two fixes were pushed.
Without them
`main` is red on `🔴 Gate: Static analysis` and `CI / required`.

## 1. `.envrc` — Hypatia critical `secret_detected`

#27 turned the Hypatia step in `static-analysis-gate.yml` from a **fake
gate**
into a real one. Before #27 it passed without ever scanning, via three
separate
routes:

- `continue-on-error: true` on the scanner build,
- `if: steps.build.outputs.ready == 'true'` skipping the scan when that
build failed,
- `echo "[]" > hypatia-findings.json` overwriting unparseable output
with an empty array.

#27 pins the scanner to a commit, verifies the SHA, builds it properly,
and fails
on critical findings. It went red because it **started working** — this
is not a
regression.

The first thing it caught:

```
.envrc:24   # export API_KEY="..."
```

A commented-out placeholder, so a false positive — but the fix is to
stop writing
assignment-shaped comments rather than to suppress the finding. The
guidance is
kept in prose, pointing at the gitignored `.env`.

The scan also reports **7 `high`** findings (`instant-sync.yml`,
`build/setup.sh`,
`src/interface/ffi/src/main.zig` ×2, and duplicates). Those do not gate
and are
left for separate triage rather than being swept in here.

## 2. `ci.yml` — Zig setup failed inside the Idris2 container

The pinned `idris2-pack` image ships no `xz` binary, so `setup-zig`'s
`.tar.xz`
download died:

```
tar (child): xz: Cannot exec: No such file or directory
Error: The process '/usr/bin/tar' failed with exit code 2
```

Installs `xz-utils` first, guarded by a `command -v` check so it is a
no-op on
images that already have it.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: hyperpolymath

.envrc

@@ -20,8 +20,9 @@ fi
 # Project environment variables
 export PROJECT_NAME="Haec"
 export RSR_TIER="infrastructure"
-# export DATABASE_URL="..."
-# export API_KEY="..."
+# Project secrets (DATABASE_URL, API_KEY, ...) belong in .env, which is
+# gitignored and sourced below. Do not add them here: .envrc is committed,
+# and assignment-shaped comments trip secret scanners.
 
 # Source .env if it exists (gitignored)
 dotenv_if_exists

.github/workflows/ci.yml

@@ -26,6 +26,18 @@ jobs:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      # The pinned idris2-pack image ships no xz binary, so setup-zig's
+      # .tar.xz download fails with "tar (child): xz: Cannot exec".
+      - name: Install xz (needed to unpack the Zig tarball)
+        shell: bash
+        run: |
+          set -euo pipefail
+          if ! command -v xz >/dev/null 2>&1; then
+            apt-get update -qq
+            apt-get install -y -qq --no-install-recommends xz-utils
+          fi
+          xz --version | head -1
+
       - name: Set up Zig
         uses: goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406 # v2.2.1
         with: