feat(proof-debt): add .trusted-base-ignore for scanner fixtures + worktree shadows (#355)

[standards#223](hyperpolymath/standards#223)
merged 2026-05-27 09:16Z, adding path-fragment exemption support to
`check-trusted-base.sh`.

## What

Adds `.trusted-base-ignore` with two entries:

| Pattern | Reason |
|---|---|
| `test/soundness/fixtures/` | 5 scanner test fixtures (admitted.v /
sorry.lean / agda_postulate.agda / believe_me.idr / unsafe_coerce.hs)
that exist solely to verify the detector fires |
| `.claude/worktrees/` | local agent worktree shadows that double-count
the canonical tree (cf. hypatia#343 §(d) refresh noting 10 such shadows)
|

## Why no pin bump needed

`governance-reusable.yml` (current main) fetches scripts from
`standards/main` at run-time (`ref: main` on the inner self-checkout,
per standards#219). Since standards#223 is now on main, the next CI run
on this repo will pick up the new exemption behaviour without bumping
any SHA pin in hypatia's wrapper.

## Cleanup of redundant artifacts (deferred)

The 5 inline `TRUSTED:` comments added by #352 and the 5/10 §(d)
enumeration entries added by #343 become **redundant** after this lands
but are kept for now to avoid stomping on those in-flight PRs. Follow-up
PR will remove them once #352 and #343 settle.

## Closes

hypatia#354.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.trusted-base-ignore

@@ -0,0 +1,27 @@
+# SPDX-License-Identifier: MPL-2.0
+#
+# .trusted-base-ignore — path-fragment exemptions for check-trusted-base.sh.
+#
+# Format (matches .hypatia-ignore):
+#   - Lines starting with `#` are comments.
+#   - Each non-comment, non-blank line is a path-fragment substring that
+#     exempts every escape-hatch marker whose file path contains the fragment.
+#
+# Prefer this over inline TRUSTED: comments only for whole-path/whole-directory
+# exemptions with a documented org-policy rationale. Per-site TRUSTED:/AXIOM:
+# comments remain the right tool for one-off documented escapes.
+#
+# See: standards/docs/TRUSTED-BASE-REDUCTION-POLICY.adoc (standards#223 added
+# this exemption mechanism).
+
+# ─── Scanner test fixtures ──────────────────────────────────────────────
+# Files under test/soundness/fixtures/code_safety/ exist *to be detected*
+# by Hypatia's own scanner — they are deliberate inputs to verify the
+# detector fires. Not real soundness debt.
+test/soundness/fixtures/
+
+# ─── Local agent worktree shadows ───────────────────────────────────────
+# `.claude/worktrees/` holds locally-checked-out copies of feature
+# branches; their contents shadow the canonical tree and cause
+# double-counting in self-scans. Not part of the committed source.
+.claude/worktrees/