fix(ci): make ECHIDNA dangerous-pattern scan ignore comments

The scan grepped for literal tokens (believe_me, assert_total, assert_smaller,
unsafePerformIO) anywhere in *.idr — including inside comments. So legitimate
documentation (e.g. a proof's doc string noting it needs 'no assert_smaller')
would fail the gate. Strip doc (|||) and line (--) comments before matching, so
only genuine code uses count. Also drop the deleted modules/ path.

Verified locally: clean tree scans 0; a pattern named in a ||| or -- comment is
ignored while a real use in code is still caught and fails the gate.

Author: Claude

.github/workflows/echidna-validation.yml

@@ -31,17 +31,26 @@ jobs:
 
       - name: Dangerous pattern scan (Idris2)
         run: |
-          echo "=== Idris2 Dangerous Pattern Scan ==="
+          echo "=== Idris2 Dangerous Pattern Scan (code only; comments excluded) ==="
           ISSUES=0
           for pattern in "believe_me" "assert_total" "assert_smaller" "unsafePerformIO"; do
-            FOUND=$(grep -rn "$pattern" ochrance-core/ modules/ src/abi/ --include="*.idr" 2>/dev/null | wc -l || echo 0)
-            if [ "$FOUND" -gt 0 ]; then
-              echo "CRITICAL: Found $FOUND instances of '$pattern'"
-              grep -rn "$pattern" ochrance-core/ modules/ src/abi/ --include="*.idr" 2>/dev/null
-              ISSUES=$((ISSUES + FOUND))
+            # Strip doc comments (||| ...) and line comments (-- ...) before
+            # matching, so documentation that merely names a pattern is not
+            # flagged: only genuine uses in code count. Without this, a doc
+            # string like "this proof needs no assert_smaller" would fail the gate.
+            MATCHES=""
+            for f in $(find ochrance-core/ src/abi/ -name "*.idr" 2>/dev/null); do
+              M=$(sed -e 's/|||.*$//' -e 's/--.*$//' "$f" | grep -n "$pattern" | sed "s|^|$f:|" || true)
+              [ -n "$M" ] && MATCHES="${MATCHES}${M}"$'\n'
+            done
+            N=$(printf '%s' "$MATCHES" | grep -c . || true)
+            if [ "$N" -gt 0 ]; then
+              echo "CRITICAL: Found $N use(s) of '$pattern' in code:"
+              printf '%s\n' "$MATCHES"
+              ISSUES=$((ISSUES + N))
             fi
           done
-          echo "Total dangerous patterns: $ISSUES"
+          echo "Total dangerous patterns (in code): $ISSUES"
           echo "dangerous_count=$ISSUES" >> $GITHUB_OUTPUT
 
           if [ "$ISSUES" -gt 0 ]; then
@@ -53,7 +62,7 @@ jobs:
         run: |
           echo "=== Totality Enforcement ==="
           MISSING=0
-          for f in $(find ochrance-core/ modules/ src/abi/ -name "*.idr" 2>/dev/null); do
+          for f in $(find ochrance-core/ src/abi/ -name "*.idr" 2>/dev/null); do
             if ! grep -q "%default total" "$f"; then
               echo "WARNING: $f missing '%default total'"
               MISSING=$((MISSING + 1))
@@ -67,11 +76,11 @@ jobs:
       - name: Partial function check
         run: |
           echo "=== Partial Function Check ==="
-          PARTIAL=$(grep -rn "^partial" ochrance-core/ modules/ src/abi/ --include="*.idr" 2>/dev/null | wc -l || echo 0)
+          PARTIAL=$(grep -rn "^partial" ochrance-core/ src/abi/ --include="*.idr" 2>/dev/null | wc -l || echo 0)
           echo "Explicitly partial functions: $PARTIAL"
           if [ "$PARTIAL" -gt 0 ]; then
             echo "Review required:"
-            grep -rn "^partial" ochrance-core/ modules/ src/abi/ --include="*.idr" 2>/dev/null
+            grep -rn "^partial" ochrance-core/ src/abi/ --include="*.idr" 2>/dev/null
           fi
 
       - name: FFI stub status
@@ -100,7 +109,7 @@ jobs:
         run: |
           echo "## ECHIDNA Validation Results" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
-          echo "- Scanned: ochrance-core/, modules/, src/abi/, ffi/zig/" >> $GITHUB_STEP_SUMMARY
+          echo "- Scanned: ochrance-core/, src/abi/, ffi/zig/" >> $GITHUB_STEP_SUMMARY
           echo "- Checks: dangerous patterns (believe_me etc), totality enforcement, partial functions, FFI stub status, Zig safety" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "*Powered by ECHIDNA neurosymbolic verification*" >> $GITHUB_STEP_SUMMARY