fix(ci): clear lint-workflows + lint-shell, fix container builder (companion to #43) (#44)

* fix(ci): clear lint-workflows + lint-shell; fix container builder package

Companion fix driven by cicd-squabbler's diagnosis of PR #43, which is
blocked behind five reds none of which its 2-line Dependabot diff caused.
This addresses the reds that are genuinely fixable at source (the squabbler's
own CI-config lane + two clean code fixes), each ground-truthed from the
actual CI logs:

- lint-workflows: `.github/workflows/codeql.yml` was missing a top-level
  `permissions:` declaration. Added `permissions: read-all`.
- lint-shell: two SC2155 warnings ("declare and assign separately to avoid
  masking return values") in ipv6-config.sh:182 and ipv6-diag.sh:188. Split
  each `local x=$(...)` into a separate declaration and assignment.
- container-build: `apk add ... cargo` failed on the Chainguard wolfi-base
  repo with "cargo (no such package)". On wolfi the cargo binary ships inside
  the `rust` package, so `cargo` is dropped from the apk line (the `ipv6`
  binary target and COPY path are already correct — the app builds clean with
  `cargo build --release`). Container build is verified by CI.

Left for the owner (not forced to green here):
- The `AGPL-3.0-or-later` OCI label in the Containerfile contradicts estate
  MPL-2.0 policy. Licence edits are owner-only (no automated licence edits),
  so this is flagged, not changed.
- `governance / Well-Known` and `governance / Workflow security linter` are
  produced by the reusable workflow in hyperpolymath/standards; the fix
  belongs upstream, not on this PR.

Dependabot's PR #43 branch is left untouched; merging this to main unblocks
its re-run of the shared reds.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SUURnQUnzTXYftzWFs5pfZ

* fix(ci): renew expired security.txt; least-privilege codeql permissions

Two reds surfaced by this PR's own CI, both fixed at source:

- governance / Well-Known: `.well-known/security.txt` had `Expires:
  2025-12-31`, so the RFC 9116 check failed with "security.txt EXPIRED".
  Renewed to 2027-07-03 (the PGP block is a documented placeholder, not a
  real signature, so nothing is invalidated). This is honest maintenance —
  the check wants a non-expired contact file and now gets one.

- SonarQube githubactions:S8234: the `permissions: read-all` added to
  codeql.yml (to satisfy the workflow-linter's top-level permissions
  requirement) was flagged as overly broad. Switched to least-privilege
  block form (`contents: read`), which satisfies BOTH the linter (a
  top-level `permissions:` key is present) and Sonar (minimal scope). The
  workflow's only job is a disabled placeholder, so read access suffices.

Note for the owner: the estate convention of `permissions: read-all` in the
other workflows will trip Sonar S8234 whenever one of them is next touched;
worth standardising on least-privilege block form across the repo.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SUURnQUnzTXYftzWFs5pfZ

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/codeql.yml

@@ -5,6 +5,13 @@ name: CodeQL Security Analysis
 on:
   workflow_dispatch:  # Manual trigger only
 
+# Least-privilege permissions: satisfies the workflow-linter's top-level
+# `permissions:` requirement AND SonarQube githubactions:S8234, which flags
+# the broad `read-all`. This workflow's only job is a disabled placeholder,
+# so read access to repository contents is more than sufficient.
+permissions:
+  contents: read
+
 # Estate guardrail: cancel superseded runs so re-pushes / rebased PR
 # updates do not pile up queued runs against the shared account-wide
 # Actions concurrency pool. Applied only to read-only check workflows

.well-known/security.txt

@@ -5,7 +5,7 @@ Hash: SHA256
 
 Contact: security@ipv6-only.example.com
 Contact: https://github.com/Hyperpolymath/ipv6-only/security/advisories/new
-Expires: 2025-12-31T23:59:59.000Z
+Expires: 2027-07-03T00:00:00.000Z
 Preferred-Languages: en
 Canonical: https://raw.githubusercontent.com/Hyperpolymath/ipv6-only/main/.well-known/security.txt
 Policy: https://github.com/Hyperpolymath/ipv6-only/blob/main/security.md

Containerfile

@@ -6,10 +6,12 @@
 # Build stage for Rust binaries
 FROM cgr.dev/chainguard/wolfi-base:latest AS builder
 
-# Install Rust and build dependencies
+# Install Rust and build dependencies. On the Chainguard wolfi apk repo the
+# `cargo` binary ships inside the `rust` package (there is no standalone
+# `cargo` package — `apk add cargo` fails with "no such package"), so it is
+# not listed separately here.
 RUN apk add --no-cache \
     rust \
-    cargo \
     build-base
 
 WORKDIR /build

src/scripts/ipv6-config.sh

@@ -179,7 +179,8 @@ show_config() {
     echo ""
 
     echo "IPv6 Status:"
-    local disabled=$(sysctl -n net.ipv6.conf.all.disable_ipv6 2>/dev/null || echo "unknown")
+    local disabled
+    disabled=$(sysctl -n net.ipv6.conf.all.disable_ipv6 2>/dev/null || echo "unknown")
     if [ "$disabled" = "0" ]; then
         echo "  ✓ IPv6 is ENABLED"
     else

src/scripts/ipv6-diag.sh

@@ -185,7 +185,8 @@ check_sysctl() {
 check_privacy_extensions() {
     print_header "Privacy Extensions Status"
 
-    local use_tempaddr=$(sysctl -n net.ipv6.conf.all.use_tempaddr 2>/dev/null || echo "N/A")
+    local use_tempaddr
+    use_tempaddr=$(sysctl -n net.ipv6.conf.all.use_tempaddr 2>/dev/null || echo "N/A")
 
     case $use_tempaddr in
         0)