feat(proof-debt): add .trusted-base-ignore for scanner self-reference false positives (#29)

standards#223 merged 2026-05-27 adding path-fragment exemption support
to check-trusted-base.sh. governance.yml here uses @main floating pin,
so the new exemption mechanism is available on the next CI run.

Exempts the 2 scanner-self-reference sites that PR #27 currently
annotates inline with TRUSTED: comments:

  - src/scanners/banned_patterns.rs — detector pattern table mentions
    the strings it must detect.
  - tests/scanners.rs — test fixture includes the pattern under test.

The inline TRUSTED: comments in #27 remain valid (script accepts
either mechanism) but become redundant after this lands. Follow-up
PR can remove them once #27 settles.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.trusted-base-ignore

@@ -0,0 +1,18 @@
+# SPDX-License-Identifier: MPL-2.0
+#
+# .trusted-base-ignore — path-fragment exemptions for check-trusted-base.sh.
+#
+# Format (matches .hypatia-ignore):
+#   - Lines starting with `#` are comments.
+#   - Each non-comment, non-blank line is a path-fragment substring that
+#     exempts every escape-hatch marker whose file path contains the fragment.
+#
+# See: standards/docs/TRUSTED-BASE-REDUCTION-POLICY.adoc (standards#223 added
+# this exemption mechanism).
+
+# ─── Scanner detector + test code ───────────────────────────────────────
+# The banned-pattern scanner has to mention the patterns it detects;
+# the test fixture has to include the pattern under test. Both are
+# scanner-self-reference false positives, not real unsafe code.
+src/scanners/banned_patterns.rs
+tests/scanners.rs