fix(governance): scan a clean caller tree — don't scan the .standards-checkout tooling

Follow-up to #455/#464. The baseline gate checks out standards' scripts/ into
`.standards-checkout/` (to get apply-baseline.sh), but that directory lives
INSIDE the caller's working tree — so `hypatia-cli.sh scan .` scanned it too and
reported standards' OWN files as the caller's findings. On neurophone#172 this
surfaced 4 phantom findings from the tooling checkout: a banned-language `.ts`
(critical) and three `shell_download` bootstrap.sh scripts (high), none of which
are the caller's code. Every adopting repo would inherit these.

Fix: copy apply-baseline.sh to $RUNNER_TEMP and `rm -rf .standards-checkout`
BEFORE the scan, then run the filter from $RUNNER_TEMP. hypatia now only ever
sees the caller's own tree; the tooling checkout can't pollute the finding set.

Completes the estate-wide gate: with #455 (baseline consulted) + #464 (filter
actually runs) + this (clean scan tree), validate-hypatia-baseline finally
behaves as intended — suppress a repo's acknowledged baseline entries, fail on
genuinely-new findings, and never conflate the tooling with the repo under audit.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0172RBMz3qYjb1ttzD2i7RNh

Author: claude

.github/workflows/governance-reusable.yml

@@ -128,6 +128,14 @@ jobs:
           BLOCKING_THRESHOLD: info
         run: |
           echo "Scanning repository: ${{ github.repository }} (checking baseline)"
+          # Move the baseline filter OUT of the scanned tree, then delete the
+          # standards checkout, so `hypatia scan .` only ever sees the CALLER's
+          # own files. Without this, `.standards-checkout/` (the tooling we
+          # checked out to get apply-baseline.sh) is itself scanned, and
+          # standards' own files get reported as the caller's findings (a banned
+          # `.ts`, `shell_download` bootstrap.sh scripts, etc.).
+          cp .standards-checkout/scripts/apply-baseline.sh "$RUNNER_TEMP/apply-baseline.sh"
+          rm -rf .standards-checkout
           # hypatia's `scan` exits non-zero whenever it finds anything — that is
           # by design, and under `bash -e` it would abort this step at this line,
           # before the baseline filter (the real gate) ever runs. Tolerate the
@@ -160,7 +168,7 @@ jobs:
           # suppresses only exact matches. Exits non-zero iff a kept finding is at
           # or above BLOCKING_THRESHOLD. (Validated against synthetic fixtures;
           # see the PR description.)
-          bash .standards-checkout/scripts/apply-baseline.sh \
+          bash "$RUNNER_TEMP/apply-baseline.sh" \
             hypatia-findings.json .hypatia-baseline.json blocking
   language-policy:
     name: Language / package anti-pattern policy