chore: estate-wide chore + stale-path sweep (2026-04-17)

Part of the estate-wide 2026-04-17 cleanup pass. Commits chore-safe
content only: docs, workflow YAML, gitignore, a2ml migration drift,
editorconfig, ncl. Dependency manifests (Cargo.toml/.lock, package.json,
mix.exs, etc.) and source files intentionally held back so no broken
intermediate states where a .rs commit splits from its Cargo.toml.

Also includes stale-path fixes for four ecosystem moves:
  hypatia       -> verification-ecosystem/hypatia
  echidna       -> verification-ecosystem/echidna
  ephapax       -> developer-ecosystem/nextgen-languages/ephapax
  panic-attacker -> games-ecosystem/panic-attacker

Staged files: 12
Held back (source / dep-manifests): 2

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/codeql.yml

@@ -57,7 +57,7 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
     # Add any setup steps before running the `github/codeql-action/init` action.
     # This includes steps like installing compilers or runtimes (`actions/setup-node`

.github/workflows/generator-generic-ossf-slsa3-publish.yml

@@ -23,7 +23,7 @@ jobs:
       digests: ${{ steps.hash.outputs.digests }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       # ========================================================
       #

.github/workflows/jekyll-gh-pages.yml

@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup Pages
         uses: actions/configure-pages@v5
       - name: Build with Jekyll

.github/workflows/php.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
     - name: Validate composer.json and composer.lock
       run: composer validate --strict

.github/workflows/rsr-antipattern.yml

@@ -16,7 +16,7 @@ jobs:
   antipattern-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Check for TypeScript
         run: |

.github/workflows/rust.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
     - name: Build
       run: cargo build --verbose
     - name: Run tests

.gitignore

@@ -45,3 +45,10 @@ logs/
 # Coverage reports
 tarpaulin-report.html
 coverage/
+target/
+node_modules/
+_build/
+deps/
+.elixir_ls/
+build/
+dist/