fix: green main CI — Hypatia SD022 (sibling doc) + crossbeam-epoch advisory

[hyperpolymath]

Summary

#178 merged with two checks red; both are now red on main. This follow-up greens them. Neither is a regression in application code — one is a cross-repo-awareness gap in a scanner heuristic, the other a newly-published upstream advisory.

Changes

• docs/governance/SIBLING-INTEGRATIONS.adoc — the new governance doc from docs(ecosystem): ground-truth sibling integrations + launcher carve-out #178 tripped two structural_drift/SD022 findings (doc references src/Burble/, doc references src/core/). Hypatia's rename-drift heuristic has no cross-repo awareness, so it flags any src/<dir>/ it cannot resolve locally — even a path the doc explicitly attributes to a sibling repo. Rather than add two more acknowledged false-positives to .hypatia-baseline.json, the two sibling artefacts are now cited by module/file name (Burble.ABI.NearbyPresence Idris2 module; panll's EventChain.res parser) instead of by src/<dir>/ path. Accurate, and the SD022 trigger disappears — so the gate stays maximally strict with no new suppressions.
• Cargo.lock — bump crossbeam-epoch 0.9.18 → 0.9.20 for RUSTSEC-2026-0204 (published 2026-07-06: invalid pointer dereference in the fmt::Pointer impl for Atomic/Shared). It is a transitive dependency, so the advisory turned rust-ci / Cargo audit red on every branch without any local code change. Surgical cargo update -p crossbeam-epoch --precise 0.9.20; only the version + checksum move (the crate's own crossbeam-utils dep is unchanged).

RSR Quality Checklist

Required

• Tests pass — no application code changed; lockfile patch bump + doc wording
• Code is formatted (cargo fmt --check) — verified clean
• Linter clean — no Rust source changed
• No banned language patterns
• No unsafe without // SAFETY: — n/a
• No proof escape hatches — n/a
• SPDX headers present — files pre-existing/headered
• No secrets included

As Applicable

• .machine_readable/6a2/* — not needed
• Documentation updated (governance doc wording)
• New dependencies reviewed — patch bump of an existing transitive dep, same licence

Testing

• cargo update -p crossbeam-epoch --precise 0.9.20 resolved the full graph (incl. the conative-gating git dep) and moved only that crate → crossbeam-epoch v0.9.18 -> v0.9.20.
• cargo fmt --check → exit 0.
• SD022 reproduction: the Hypatia baseline job reported exactly these two medium SD022 findings as baseline_status: "new" on docs/governance/SIBLING-INTEGRATIONS.adoc; the reword removes every src/<dir>/ dir-form (only the real local file crates/claude-client/src/lib.rs remains, which does not match the heuristic).
• Full cargo build/cargo audit are verified in CI (local build is gated on the external conative-gating egress).

🤖 Generated with Claude Code

https://claude.ai/code/session_0172RBMz3qYjb1ttzD2i7RNh

---

Generated by Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud