fix(ci): Hypatia reusable gate uploads findings instead of failing opaquely (#424)

## Make the Hypatia reusable gate **visible**, not opaque

The `Run Hypatia scan` step runs `hypatia-cli.sh scan` under the default
`bash -eo pipefail`. `hypatia-cli` **exits 1 whenever findings exist**
(documented behaviour), so the step aborts at the scan line *before* the
`jq` counts / `$GITHUB_OUTPUT` / step-summary run — and because
**`Upload findings artifacts` had no `if:`**, it's skipped on that
failure. Result: a red ❌ with **zero visible findings**.

### Changes (minimal, licence-neutral)

1. **scan** — add `--exit-zero` (the CLI flag built exactly for "CI
gates on the counts"), so the step succeeds and the severity counts /
outputs / step-summary populate. Gating is already done on the counts
(the `Check for critical issues` step warns-don't-fail / fix-forward),
not on the scanner's exit code.
2. **upload** — `if: always()` so findings upload even when an earlier
step (build / scan) fails.

No behaviour change for clean repos; failing repos now surface findings
as an **artifact + step summary** instead of an opaque red X.

> Does **not** touch the file's SPDX header (left as-is per the
no-automated-licence-edits guardrail).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/hypatia-scan-reusable.yml

@@ -51,7 +51,11 @@ jobs:
         id: scan
         run: |
           echo "Scanning repository: ${{ github.repository }}"
-          HYPATIA_FORMAT=json "$HOME/hypatia/hypatia-cli.sh" scan . > hypatia-findings.json
+          # --exit-zero: hypatia-cli exits 1 when findings exist; under the default
+          # `bash -eo pipefail` that aborts this step before the counts/outputs/summary
+          # run AND skips the upload, so the gate fails opaquely. Gate on the severity
+          # counts below, not on the scanner's exit code.
+          HYPATIA_FORMAT=json "$HOME/hypatia/hypatia-cli.sh" scan . --exit-zero > hypatia-findings.json
 
           FINDING_COUNT=$(jq '. | length' hypatia-findings.json 2>/dev/null || echo 0)
           CRITICAL=$(jq '[.[] | select(.severity == "critical")] | length' hypatia-findings.json 2>/dev/null || echo 0)
@@ -83,6 +87,7 @@ jobs:
           fi
 
       - name: Upload findings artifacts
+        if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: hypatia-scan-findings