fix: aletheia has not compiled since June — repair it, then gate it

[hyperpolymath]

Summary

A sitrep on this repo turned up something bigger than the CI gap it started as:
aletheia has not compiled since 2026-06-17. This branch fixes that, then adds the
gate that would have caught it, and clears two unrelated reds.

#	Finding	State
1	aletheia fails to build — unclosed delimiter in src/config.rs	fixed & verified
2	aletheia has no CI anywhere; its 16 workflows are inert	root gate added
3	Governance red — pages.yml missing SPDX header	fixed
4	absolute-zero pinned to a nonexistent commit; Dependabot dead	re-pinned — needs your confirmation

1. The compile break

Config::load_config opened three blocks on one collapsed line and closed two.
Introduced by b5322c2 "security: remediate Track C and Track E findings" — which
correctly added a 1 MiB read cap against memory exhaustion, then dropped a brace
collapsing the block. main has been unbuildable for over a month.

The security intent is preserved exactly; the cap is retained and now commented.

2. Why nothing noticed

aletheia/ is vendored as plain tracked files (mode 100644), not a submodule.
Actions only reads .github/workflows/ at the repository root, so all 16 files under
aletheia/.github/workflows/ — rust-ci, codeql, cflite_*, SLSA3, GHCR — have
never executed. There is no standalone hyperpolymath/aletheia running them either;
it was removed from GitHub in early 2026. No root workflow mentioned cargo, and root
codeql.yml's language matrix excludes Rust. ~962 lines were completely ungated.

Adds root .github/workflows/rust-ci.yml: debug + release build, 26 unit tests,
cargo fmt --check, and a zero-dependency check enforcing the RSR Bronze constraint
from aletheia/CLAUDE.md. It uses the runner's preinstalled Rust — no new
third-party action, no added supply-chain surface.

Also adds aletheia/.github/workflows/README.md so nobody edits an inert workflow again.

What I deliberately did not gate

Two things are genuinely red, and a hollow green job is worse than no job. Neither is
masked with continue-on-error; both are documented in the workflow header:

• Integration tests: 27 of 29 fail. They exercise a CLI surface — --help,
  --version, --format=, --badge, --html, --init-hook — that src/main.rs
  does not implement. It parses only --json and --sarif.
• clippy -D warnings: 25 findings, mostly dead code.

These share one root cause: the crate was split into 5 modules (962 lines) but
main.rs is only 117 lines and never wires most of them up. glob_match,
check_path_security, parse_toml, TomlValue, PathCheckResult are all unreachable.
aletheia is mid-refactor and incomplete — its 823-line test suite is closer to a
specification of the intended tool than a description of the current one.

That is a product decision, not a CI fix, so I have left it to you.

4. Submodule re-pin — please confirm

ad085baa does not exist upstream (API 422), nor on the GitLab or Codeberg mirrors;
orphaned by a force-push during the Ddraig rollout. Dependabot has failed since
2026-07-20 with upload-pack: not our ref.

Re-pinned to current upstream main 87902bb7. This is a semantic bump, not a
restore — the old pin's content is unrecoverable, so I cannot verify 87902bb7 is the
intended CNO state.

It may also not be durable: this repo has already oscillated three times (#89 → bef4c92
→ #117). Worth settling submodule-vs-vendor, or barring force-push on absolute-zero.

Verification

All run locally from a clean target dir before pushing:

build:    PASS      release:  PASS
tests:    26 passed; 0 failed
fmt:      PASS      zero-dep: PASS
git submodule update --init absolute-zero  ->  checks out 87902bb7 cleanly

Notes

• PROOF-NEEDS.md is stale: it claims one Admitted in y_not_cno. There are
  zero — it is a documented KEPT AXIOM. A declared trust assumption, not an unproven
  hole. Worth correcting separately.
• rustfmt.toml sets 18 nightly-only options that stable rustfmt silently ignores.
• aletheia/Cargo.toml still points repository at the deleted GitHub repo.
• Untouched: the uncommitted SonarCloud edits in the working copy (unpinned @master),
  and the 4 unpushed local commits. Both are yours to decide.

🤖 Generated with Claude Code

[hyperpolymath]

CI results + one more fix

Rust CI is green on its first ever run — Build (debug+release), Unit tests, Formatting all success. The gate this repo has never had now exists and passes.

Governance: SPDX fixed, second defect uncovered, one left deliberately alone

Fixing the SPDX header advanced the workflow-security linter past its first gate (it exit 1s straight after the SPDX/permissions block), which revealed a defect that had been masked all along — the same file also had 4 unpinned actions:

actions/checkout@v4  x2 · actions/upload-pages-artifact@v3 · actions/deploy-pages@v4

Both faults share one cause: pages.yml was dropped in by the Ddraig SSG mass-rollout (#121) without this repo's SPDX + SHA-pinning conventions.

Now pinned, reusing the vetted SHAs already in casket-pages.yml (the active, compliant Pages workflow) so the two agree. SPDX errors: 0. Unpinned actions at root: 0.

Check Workflow Staleness will stay red — please don't read that as a regression

It was already failing on main before this branch existed (run 29688088909). The standards reusable pins d7c2271 are 59 commits / 24 days behind HEAD 8813ecf.

I have deliberately not refreshed them here:

• that refresh is shared across all ~54 callers and is coordinated centrally (scripts/propagate-workflow-pins.sh);
• there is an active finding that consumers should not be re-pinned yet — the gitleaks reusable runs detect --source . with no --config, so re-pinning early reverts on false positives.

Its remediation text also says "Remove legacy scorecard-enforcer.yml". That file does not exist at the repo root — the only copy is aletheia/.github/workflows/scorecard-enforcer.yml, one of the inert files. The log prints no path, so whether the check reaches into the nested directory is unverified. If it does, that is a strong argument for deleting the inert set rather than merely documenting it.