ci(governance): adopt the hypatia-baseline fix (bump governance-reusable pin) (#171)

## Summary

Adopts the estate-wide fix from **standards#455** (merged) so
neurophone's last red — `governance / Validate Hypatia Baseline` — can
finally go **green** honestly.

That job previously ran `hypatia-cli.sh scan .`, counted raw findings,
and failed on any, **ignoring `.hypatia-baseline.json` entirely**.
standards#455 wired `scripts/apply-baseline.sh` into it (with path
relativization for the hypatia#566 absolute-path gap), so it now
suppresses *acknowledged* baseline entries while still failing on any
*new* finding.

This bumps neurophone's `governance-reusable.yml` pin **`7c9db0e` →
`832b157`** (current standards `main`, fix confirmed present) in
`.github/workflows/governance.yml`.

## Scope — surgical on purpose

- **Only `governance-reusable` is bumped.** The other five standards
reusables stay at `7c9db0e` — notably `rust-ci` (deliberately pinned
there for the standards#439 toolchain fix), plus `secret-scanner`,
`scorecard`, `hypatia-scan`, `mirror` — to avoid pulling unrelated
deltas.
- This bump *does* pull the **governance** delta since `7c9db0e`
(standards #453 "Wave 0", #457/#458 "Wave 4"). **neurophone's full CI on
this PR is the check** for any surprise from that delta — I'll report
before/after, and flag (not paper over) anything the fuller governance
reusable newly-reds.

## Expected outcome

- `governance / Validate Hypatia Baseline` → **green** (the repo's
honestly-baselined findings — bench panics, `no_tests`
scanner-limitation, cross-repo SD022, git_state flux — are now
suppressed; validated behaviour in standards#455).
- Everything else → unchanged / still green.

## Verification

The suppression logic was ground-truthed against synthetic fixtures in
standards#455 (baselined → pass; a new finding → fail). This PR is the
live end-to-end proof against neurophone's *real*
`.hypatia-baseline.json` and a freshly-built hypatia scanner in CI.

Left as a **draft** pending the CI result + your review, since it
changes which findings a security gate blocks on.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_0172RBMz3qYjb1ttzD2i7RNh

---
_Generated by [Claude
Code](https://claude.ai/code/session_0172RBMz3qYjb1ttzD2i7RNh)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/governance.yml

@@ -31,4 +31,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@7c9db0e5909aab77bf11a444ade3b95c1d2b702e
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@832b1578ecaeeb27dad54f133630ebd670f6e752 # bumped 2026-07-03: standards#455 wires apply-baseline.sh into validate-hypatia-baseline (the check now actually consults .hypatia-baseline.json). Other standards reusables intentionally left at 7c9db0e.