fix(ci+docs): address all Hypatia scan findings from PR #34

Workflow fixes (high/medium severity):
- Add timeout-minutes to all jobs (hypatia-scan, mirror, rust-ci,
  scorecard, secret-scanner, release, scorecard-enforcer)
- scorecard-enforcer: split scorecard publish job from run steps into
  separate scorecard-publish + scorecard-enforce jobs (scorecard_publish_with_run_step)
- scorecard.yml: add explicit job-level permissions for the analysis
  caller job (scorecard_wrapper_missing_job_permissions)
- instant-sync.yml: add FARM_DISPATCH_TOKEN presence gate before
  repository-dispatch action (secret_action_without_presence_gate)
- rsr-antipattern.yml: anchor TypeScript Exemptions heading regex to
  line-start with heading marker (unanchored_heading_regex)

SD022 structural drift fixes (src/abi/ → src/interface/Abi/):
- docs/RSR_OUTLINE.adoc
- docs/developer/ABI-FFI-README.adoc
- docs/governance/MAINTENANCE-CHECKLIST.adoc
- docs/practice/AI-CONVENTIONS.adoc
- src/interface/ffi/src/main.zig

SD009 template placeholder fix:
- src/interface/ffi/src/main.zig: replace {{PROJECT}}/{{project}}
  with nextgen_typing

https://claude.ai/code/session_01S7PoiLxheftavnuFPE7Uq4

Author: claude

.github/workflows/hypatia-scan.yml

@@ -25,5 +25,6 @@ permissions:
 
 jobs:
   hypatia:
+    timeout-minutes: 30
     uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@915139d73560e65a8240b8fc7768698658502c89
     secrets: inherit

.github/workflows/instant-sync.yml

@@ -14,8 +14,22 @@ permissions:
 jobs:
   dispatch:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
+      - name: Check FARM_DISPATCH_TOKEN presence
+        id: gate
+        env:
+          TOKEN: ${{ secrets.FARM_DISPATCH_TOKEN }}
+        run: |
+          if [ -n "$TOKEN" ]; then
+            echo "present=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "present=false" >> "$GITHUB_OUTPUT"
+            echo "::notice::FARM_DISPATCH_TOKEN not set — skipping propagation"
+          fi
+
       - name: Trigger Propagation
+        if: steps.gate.outputs.present == 'true'
         uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3
         with:
           token: ${{ secrets.FARM_DISPATCH_TOKEN }}
@@ -30,6 +44,7 @@ jobs:
             }
 
       - name: Confirm
+        if: steps.gate.outputs.present == 'true'
         env:
           REPO_NAME: ${{ github.event.repository.name }}
         run: echo "::notice::Propagation triggered for ${REPO_NAME}"

.github/workflows/mirror.yml

@@ -11,5 +11,6 @@ permissions:
 
 jobs:
   mirror:
+    timeout-minutes: 15
     uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@e6b2884722350515934d443daf23442f2195796f
     secrets: inherit

.github/workflows/release.yml

@@ -18,6 +18,7 @@ jobs:
   build:
     name: Build Artifacts
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       contents: read
     steps:
@@ -78,6 +79,7 @@ jobs:
   changelog:
     name: Generate Changelog
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       contents: read
     outputs:
@@ -124,6 +126,7 @@ jobs:
     name: Create GitHub Release
     needs: [build, changelog]
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       contents: write
     steps:
@@ -151,6 +154,7 @@ jobs:
   provenance:
     name: SLSA Provenance
     needs: [build]
+    timeout-minutes: 20
     permissions:
       actions: read
       id-token: write

.github/workflows/rsr-antipattern.yml

@@ -87,7 +87,7 @@ jobs:
           if claude_md.exists():
               in_table = False
               for line in claude_md.read_text(encoding='utf-8').splitlines():
-                  if re.search(r'TypeScript [Ee]xemptions', line):
+                  if re.search(r'^[#=]+\s+.*TypeScript [Ee]xemptions', line):
                       in_table = True
                       continue
                   if in_table and line.startswith(('### ', '## ', '# ')):

.github/workflows/rust-ci.yml

@@ -14,4 +14,5 @@ permissions:
 
 jobs:
   rust-ci:
+    timeout-minutes: 30
     uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@cc5a372af1af1b202c17f1b21efd954e6c038bef

.github/workflows/scorecard-enforcer.yml

@@ -21,11 +21,15 @@ permissions:
   contents: read
 
 jobs:
-  scorecard:
+  # Scorecard publish job — must be isolated from run steps per OpenSSF guidance.
+  scorecard-publish:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       security-events: write
       id-token: write  # For OIDC
+      contents: read
+      actions: read
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
@@ -43,6 +47,25 @@ jobs:
         with:
           sarif_file: results.sarif
 
+  # Score enforcement job — separate from publish to satisfy scorecard_publish_with_run_step rule.
+  scorecard-enforce:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    needs: scorecard-publish
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run Scorecard (score only, no publish)
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: false
+
       - name: Check minimum score
         run: |
           # Parse score from results
@@ -61,6 +84,7 @@ jobs:
   # Check specific high-priority items
   check-critical:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 

.github/workflows/scorecard.yml

@@ -12,5 +12,11 @@ permissions: read-all
 
 jobs:
   analysis:
+    timeout-minutes: 30
+    permissions:
+      security-events: write
+      id-token: write
+      contents: read
+      actions: read
     uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@e0caf11508a3989574713c78f5f444f2ce5e33ef
     secrets: inherit

.github/workflows/secret-scanner.yml

@@ -15,5 +15,6 @@ permissions:
 
 jobs:
   scan:
+    timeout-minutes: 15
     uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@3e4bd4c93911750727e2e4c66dff859e00079da0
     secrets: inherit

docs/RSR_OUTLINE.adoc

@@ -101,7 +101,7 @@ just validate-rsr
 |`AI.a2ml`
 |Claude-specific instructions
 
-|`src/abi/`
+|`src/interface/Abi/`
 |Idris2 ABI definitions (Types, Layout, Foreign)
 
 |`ffi/zig/`
@@ -177,7 +177,7 @@ project/
 │   ├── TOPOLOGY-GUIDE.adoc
 │   ├── generated/
 │   └── man/
-├── src/abi/                   # Idris2 ABI definitions
+├── src/interface/Abi/         # Idris2 ABI definitions
 │   ├── Types.idr
 │   ├── Layout.idr
 │   └── Foreign.idr