chore(ci): convert hypatia-scan.yml to wrapper of standards reusable (#71)

## Summary

Replaces the per-repo `hypatia-scan.yml` (416 lines) with a 29-line
wrapper calling
`hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@2569c10e831e293f9dd6580d82a494aca039deee`
(standards#191 HEAD SHA).

Behaviour-preserving: identical triggers
(push/pull_request/schedule/workflow_dispatch), same concurrency group,
same permissions (contents:read + security-events:write +
pull-requests:write), same secrets passthrough.

Same pattern as the rust-ci wrapper sweep (standards#174 + 82 wrapper
PRs filed 2026-05-26).

## Pin-to-not-yet-merged-SHA

Intentional: the SHA points at standards#191's PR HEAD. The wrapper file
is staged but the action runner won't load the reusable until
standards#191 lands on main.

## Test plan

- [ ] `pull_request` triggers run main's old workflow file
(target-branch semantics)
- [ ] After standards#191 merges, the next push exercises the reusable
end-to-end
- [ ] SARIF still uploads on non-fork triggers; gitbot-fleet submission
still best-effort

Refs standards#191.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Author: hyperpolymath

.github/workflows/codeql.yml

@@ -30,7 +30,10 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - language: javascript-typescript
+          # Repo source is not JS/TS; scan workflow files via the
+          # actions extractor (every repo has those). See hypatia rule
+          # codeql_language_matrix_mismatch.
+          - language: actions
             build-mode: none
 
     steps: