fix(governance): scan a clean caller tree (don't scan the .standards-checkout tooling) (#466)

## Summary

Third and final piece of the `validate-hypatia-baseline` fix (after #455
wired the filter and #464 made it run). The gate checks out standards'
`scripts/` into `.standards-checkout/` to get `apply-baseline.sh` — but
that directory sits **inside the caller's working tree**, so
`hypatia-cli.sh scan .` scanned it too and reported **standards' own
files as the caller's findings**.

Caught on neurophone#172, where 4 of the 8 "unfiltered" findings were
pure tooling pollution:
```
.standards-checkout/scripts/check-ts-allowlist.ts                      banned_language (critical)
.standards-checkout/neurosym-a2ml/scripts/bootstrap.sh                 shell_download  (high)
.standards-checkout/agentic-a2ml/scripts/bootstrap.sh                  shell_download  (high)
.standards-checkout/.../rsr-deployer/scripts/bootstrap.sh              shell_download  (high)
```
None is the caller's code. **Every** adopting repo would inherit these.

## The fix

```bash
cp .standards-checkout/scripts/apply-baseline.sh "$RUNNER_TEMP/apply-baseline.sh"
rm -rf .standards-checkout          # <- before the scan
HYPATIA_FORMAT=json … scan . …      # now only sees the caller's own tree
…
bash "$RUNNER_TEMP/apply-baseline.sh" …
```

Copy the filter out to `$RUNNER_TEMP` (outside the workspace), delete
`.standards-checkout/`, then scan. hypatia only ever sees the repo under
audit; the tooling can't pollute the finding set.

## Net effect

With **#455** (baseline actually consulted) + **#464** (filter actually
runs) + **this** (clean scan tree), the estate gate finally behaves as
intended: suppress a repo's acknowledged baseline entries, fail on
genuinely-new findings, and never conflate the tooling with the repo.
Opt-in per repo via SHA-pin as before.

Draft pending CI + your review. (As with #455/#464, this job **skips**
on standards' own CI — no baseline here — so it was reasoned through
against neurophone#172's real output.)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_0172RBMz3qYjb1ttzD2i7RNh

---
_Generated by [Claude
Code](https://claude.ai/code/session_0172RBMz3qYjb1ttzD2i7RNh)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/governance-reusable.yml

@@ -128,6 +128,14 @@ jobs:
           BLOCKING_THRESHOLD: info
         run: |
           echo "Scanning repository: ${{ github.repository }} (checking baseline)"
+          # Move the baseline filter OUT of the scanned tree, then delete the
+          # standards checkout, so `hypatia scan .` only ever sees the CALLER's
+          # own files. Without this, `.standards-checkout/` (the tooling we
+          # checked out to get apply-baseline.sh) is itself scanned, and
+          # standards' own files get reported as the caller's findings (a banned
+          # `.ts`, `shell_download` bootstrap.sh scripts, etc.).
+          cp .standards-checkout/scripts/apply-baseline.sh "$RUNNER_TEMP/apply-baseline.sh"
+          rm -rf .standards-checkout
           # hypatia's `scan` exits non-zero whenever it finds anything — that is
           # by design, and under `bash -e` it would abort this step at this line,
           # before the baseline filter (the real gate) ever runs. Tolerate the
@@ -160,7 +168,7 @@ jobs:
           # suppresses only exact matches. Exits non-zero iff a kept finding is at
           # or above BLOCKING_THRESHOLD. (Validated against synthetic fixtures;
           # see the PR description.)
-          bash .standards-checkout/scripts/apply-baseline.sh \
+          bash "$RUNNER_TEMP/apply-baseline.sh" \
             hypatia-findings.json .hypatia-baseline.json blocking
   language-policy:
     name: Language / package anti-pattern policy