fix(#34): resolve Hypatia backlog at source; finalize baseline

[hyperpolymath]

Summary

Absolute resolution of #34. Rather than enumerate the scanner's output, I ran the upstream scanner locally to find out what the "standing backlog" actually is — and it is not a security backlog:

• The upstream bash ruleset emits 1864 line-level findings, dominated by policy rules like rescript_file_present firing on every line of every .res file — a "migrate away from ReScript" policy that directly contradicts this repo's own ReScript-first language standard (CLAUDE.md).
• The single Critical "proof hole" (coq_admitted, Typing.v:447) is a false positive: it matches the word "Admitted" inside a comment documenting that a lemma was previously admitted and is now fully Qed.-proved. There is no Admitted./admit. token anywhere in the repo.
• The .ncl "Docker" finding is a false positive on a Nickel policy that itself bans Dockerfile.

So #34's items were resolved at source, not suppressed:

Finding	Disposition
concurrency.rs lock/poison unwraps (8+13)	Fixed (poison-tolerant, prior PR)
string.rs char::from_digit().unwrap()	Fixed → .expect() with the proved digit < radix ≤ 36 invariant; .hypatia-ignore entry removed
Coq coq_admitted (Critical)	Eliminated — comment reworded; finding ceases to exist
.ncl docker / proptest / playground/ / dialects/	Documented false-positive / non-shipping exemptions in .hypatia-ignore

.hypatia-baseline.json finalized: _partial: false, empty fingerprint set — noise control is structural (diff-scoped comment + .hypatia-ignore with per-entry rationale), not enumeration of unreliable output. Investigation doc updated with the #34 outcome.

Closes #34.

Test plan

• json.load validates the finalized baseline (_partial=false)
• Repo-wide scan confirms zero Admitted./admit. tokens in any .v
• string.rs invariant verified (radix ∈ [2,36], digit = num % radix < radix)
• Next Hypatia CI run: confirm the diff-scoped comment stays silent / shows no Critical for these files

https://claude.ai/code/session_016X6sPXqrpMxHRMuy46BjeS

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan — findings in this PR's changed files

1 finding(s) in files this PR modifies (of 32 repo-wide; 0 baselined, not shown).

Severity	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	1

View findings (this PR's files only)

[
  {
    "reason": "expect() in hot path (1 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/my-lang/my-lang/lib/common/string.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  }
]

Pre-existing repo-wide findings are triaged via the Hypatia backlog issue and suppressed here by .hypatia-baseline.json / .hypatia-ignore.

Powered by Hypatia Neurosymbolic CI/CD Intelligence