ci(governance): green the hypatia baseline — adopt #466 + baseline 4 verified false-positives (#173)

## Summary

The final step: turn neurophone's long-standing `governance / Validate
Hypatia Baseline` red **green — honestly**.

With the estate gate now fully repaired (standards **#455**
consult-baseline + **#464** filter-actually-runs + **#466**
scan-a-clean-tree), this:

1. **Re-pins** `governance-reusable` `f81bb04` → **`412a703`** (adopts
#466's pollution fix — the gate no longer scans the
`.standards-checkout/` tooling).
2. **Baselines the 4 remaining native findings**, all **audited as
false-positives at source** (none blind-baselined):

| File | Rule | Sev | Why it's a false-positive |
|---|---|---|---|
| `crates/claude-client/src/egress_gate.rs` | secret_detected |
**critical** | Unit test
`hardcoded_secret_is_blocked_even_in_an_otherwise_allowed_class` asserts
the gate **blocks** the literal placeholder
`sk-not-a-real-secret-value`. Not a secret. |
| `audits/audit-install-scripts.adoc` | secret_detected | **critical** |
The audit doc **quotes** the commented `# api_key = "sk-ant-..."`
placeholder to *document* it as sound. Not a secret. |
| `android/README.adoc` | SD022 | medium | References **gossamer's**
cross-repo `src/interface/…` paths (like the existing baselined
BT-PRESENCE entry). |
| `audits/assail-classifications.a2ml` | SD022 | medium | References
**panic-attack's** `src/assail/mod.rs` (correct cross-repo reference). |

Both criticals were read at source and confirmed to be a test fixture
and a documentation quote — not real credentials.

## Verified before pushing

Ran the 4 native findings through standards' `apply-baseline.sh` against
the extended baseline locally:
```
kept: 0   suppressed: 4   ->  gate exit 0 (green)
```
Post-#466 the scan sees **14 findings** (10 prior + these 4), all
suppressed, **zero tooling pollution** → the gate goes green for real.

## No silent-green

`apply-baseline.sh` keeps any finding **not** matched by a baseline
entry, so a genuinely-new finding still fails the gate. This only
suppresses the four exact, audited entries above. The five other
standards reusables stay at `7c9db0e`.

Draft pending the CI confirmation (which is the point — I'll verify the
check is finally green).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_0172RBMz3qYjb1ttzD2i7RNh

---
_Generated by [Claude
Code](https://claude.ai/code/session_0172RBMz3qYjb1ttzD2i7RNh)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/governance.yml

@@ -31,4 +31,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@f81bb0453ab7fda0cea94127d3855f83968fb9e8 # bumped 2026-07-03: standards#455 wired apply-baseline.sh into validate-hypatia-baseline AND #464 fixed it actually running (the #455 wire-in aborted under `bash -e` on the scan's exit-on-findings before the filter ran). Other standards reusables intentionally left at 7c9db0e.
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@412a7031577112b31ee287cc6060179d638d6500 # bumped 2026-07-03: standards #455 (baseline consulted) + #464 (filter runs under bash -e) + #466 (scan a clean caller tree, not the .standards-checkout tooling). Other standards reusables intentionally left at 7c9db0e.

.hypatia-baseline.json

@@ -41,5 +41,37 @@
     "type": "GS007",
     "file": ".",
     "note": "Operational/transient, not a code defect: this repo has an active multi-branch workflow (feature branches, workstream branches from parallel agent sessions) and the non-main remote branch count fluctuates by the hour as branches are opened and merged/deleted. Baselining the rule itself rather than a point-in-time count; do not read a specific branch-count number into this entry. Owner should periodically review `git branch -r` and delete fully-merged branches, but that is a routine housekeeping call, not something this baseline should force. Same uppercase-`type` schema caveat as the SD022 entry above (\"GS007\" vs `^[a-z][a-z0-9_]*$`)."
+  },
+  {
+    "severity": "critical",
+    "rule_module": "security_errors",
+    "type": "secret_detected",
+    "file": "crates/claude-client/src/egress_gate.rs",
+    "note": "Audited false positive -- NOT a real secret. The unit test `hardcoded_secret_is_blocked_even_in_an_otherwise_allowed_class` (line 292) uses the literal placeholder `api_key = \"sk-not-a-real-secret-value\"` as its fixture, asserting the egress gate BLOCKS a hardcoded-secret pattern regardless of declared class. The string literally reads 'sk-not-a-real-secret-value'; no credential is committed (corroborated by the estate secret-scanner gate, which is green). Verified at source 2026-07-03. hypatia's Generic-API-key regex cannot distinguish a test/demo placeholder from a real key. First flagged in #168; baselined here. Same absolute-path caveat as the code_safety entries above -- the finding is matched on its repo-relative file after the gate relativises hypatia's output.",
+    "tracking_issue": null
+  },
+  {
+    "severity": "critical",
+    "rule_module": "security_errors",
+    "type": "secret_detected",
+    "file": "audits/audit-install-scripts.adoc",
+    "note": "Audited false positive -- NOT a real secret. This audit document (introduced in #166) QUOTES the commented-out placeholder `# api_key = \"sk-ant-...\"` from scripts/install-termux.sh (around line 41) precisely to record it as an audited-sound false positive; the `sk-ant-...` is a literal ellipsis placeholder showing users where their OWN key goes, not a committed credential. hypatia's Generic-API-key regex matches the quoted example. Verified at source 2026-07-03.",
+    "tracking_issue": null
+  },
+  {
+    "severity": "medium",
+    "rule_module": "structural_drift",
+    "type": "SD022",
+    "file": "android/README.adoc",
+    "note": "Cross-repo reference, not local drift. The gossamer-migration README (introduced in #167 / epic #83) references gossamer's own `src/interface/abi/Types.idr` and `src/interface/ffi/src/main.zig` (around lines 96 and 119) when describing gossamer's Zig/Idris2 core -- those paths live in the sibling `gossamer` repo, not here. SD022's rename-drift heuristic has no cross-repo awareness, so it flags any `src/<dir>/` it cannot resolve locally. Same class as the docs/BT-PRESENCE-PLAN.adoc entry. Uppercase-`type` schema caveat applies (\"SD022\" vs `^[a-z][a-z0-9_]*$`). Verified at source 2026-07-03.",
+    "tracking_issue": null
+  },
+  {
+    "severity": "medium",
+    "rule_module": "structural_drift",
+    "type": "SD022",
+    "file": "audits/assail-classifications.a2ml",
+    "note": "Cross-repo reference, not local drift. This classification file (introduced in #166) references `panic-attack src/assail/mod.rs` (line 5) -- the analyzer module in the sibling `panic-attack` repo that produces these classifications -- not a path that exists (or ever existed) in neurophone. SD022 has no cross-repo awareness. Same class as the docs/BT-PRESENCE-PLAN.adoc and android/README.adoc entries. Uppercase-`type` schema caveat applies. Verified at source 2026-07-03.",
+    "tracking_issue": null
   }
 ]