ci(hypatia): fix workflow floor (upload-artifact SHA + setup-beam v1.24.0 + env.HOME) (#37)

Three independent CI bugs in `.github/workflows/hypatia-scan.yml` that
block every consumer of the RSR template floor (echo-types#30 hit all
three before merge).

1. `actions/upload-artifact` pinned to non-existent SHA `65c79d7f...` ->
`ea165f8d65b6e75b540449e92b4886f43607fa02` (canonical `v4`)
2. `erlef/setup-beam@v1.18.2` errors on ubuntu-24 runner image (`Tried
to map a target OS from env. variable 'ImageOS' (got ubuntu24), but
failed`) -> `v1.24.0` (`fc68ffb9...`)
3. `working-directory: `${{ env.HOME }}``/hypatia` resolves to
`/hypatia` (env.HOME is unset in GH Actions context). Switched to `cd
`\C:\Users\USER/hypatia`` inside the run script.

There is also a separate scanner-exit-1 vs `set -e` design issue (the
workflow comment `# Warn but don't fail` intends non-blocking) — out of
scope for this PR.

Author: hyperpolymath

.github/workflows/hypatia-scan.yml

@@ -26,7 +26,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Elixir for Hypatia scanner
-        uses: erlef/setup-beam@2f0cc07b4b9bea248ae098aba9e1a8a1de5ec24c # v1.18.2
+        uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1.24.0
         with:
           elixir-version: '1.19.4'
           otp-version: '28.3'
@@ -36,8 +36,8 @@ jobs:
           git clone --depth 1 https://github.com/hyperpolymath/hypatia.git "$HOME/hypatia"
 
       - name: Build Hypatia scanner
-        working-directory: ${{ env.HOME }}/hypatia
         run: |
+          cd "$HOME/hypatia"
           if [ ! -f hypatia-v2 ]; then
             cd scanner && mix deps.get && mix escript.build && mv hypatia ../hypatia-v2
           fi
@@ -82,7 +82,7 @@ jobs:
           fi
 
       - name: Upload findings artifacts
-        uses: actions/upload-artifact@65c79d7f54e76e4e3c7a8f34db0f4ac8b515c478 # v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: standards-self-scan
           path: |