ci(hypatia-scan): emit + upload SARIF so scans reconcile code-scanning alerts

The reusable scan produced hypatia-findings.json as an *artifact* only and
declared `security-events: read`, so it could neither create nor CLOSE
code-scanning alerts. Alerts uploaded by an earlier SARIF path (tool "Hypatia",
category "hypatia") were therefore orphaned: once the underlying code was fixed,
the fix never propagated to the Security tab and the alerts lingered as stale
"open" findings (observed on metadatastician/gossamer — ~40 of 108 open alerts
were already fixed in code but could not auto-close).

This restores the designed behaviour that lib/hypatia/sarif.ex documents:

  - run the scan a second time with HYPATIA_FORMAT=sarif -> hypatia.sarif
  - upload it via github/codeql-action/upload-sarif with category "hypatia"
  - grant security-events: write

SARIF render already filters the code_scanning_alerts meta-rules
(lib/hypatia/sarif.ex @meta_rule_modules), so re-uploading cannot self-echo
(the 7,724-alert loop the render-time filter was added to close). The upload
step is `continue-on-error: true`, so callers that still grant only
security-events: read are unaffected — and because every caller SHA-pins this
reusable, the change is opt-in: it takes effect for a repo only when that repo
bumps its pin AND grants write.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/hypatia-scan-reusable.yml

@@ -7,7 +7,7 @@ on:
 
 permissions:
   contents: read
-  security-events: read
+  security-events: write
 
 jobs:
   scan:
@@ -94,6 +94,14 @@ jobs:
           # counts below, not on the scanner's exit code.
           HYPATIA_FORMAT=json "$HOME/hypatia/hypatia-cli.sh" scan . --exit-zero > hypatia-findings.json
 
+          # Emit SARIF for the GitHub Security tab. The code_scanning_alerts
+          # meta-rules are filtered at SARIF render time (lib/hypatia/sarif.ex),
+          # so an upload can never self-echo. Same tool name ("Hypatia") and
+          # category ("hypatia") as the historical upload, so GitHub RECONCILES:
+          # findings fixed in code since the last scan auto-close instead of
+          # orphaning as stale open alerts.
+          HYPATIA_FORMAT=sarif "$HOME/hypatia/hypatia-cli.sh" scan . --exit-zero > hypatia.sarif || echo '{"version":"2.1.0","runs":[]}' > hypatia.sarif
+
           FINDING_COUNT=$(jq '. | length' hypatia-findings.json 2>/dev/null || echo 0)
           CRITICAL=$(jq '[.[] | select(.severity == "critical")] | length' hypatia-findings.json 2>/dev/null || echo 0)
           HIGH=$(jq '[.[] | select(.severity == "high")] | length' hypatia-findings.json 2>/dev/null || echo 0)
@@ -113,6 +121,14 @@ jobs:
           echo "| Medium   | $MEDIUM |" >> $GITHUB_STEP_SUMMARY
           echo "| **Total**| $FINDING_COUNT |" >> $GITHUB_STEP_SUMMARY
 
+      - name: Upload SARIF to code scanning
+        if: always()
+        continue-on-error: true          # callers granting only security-events:read skip gracefully
+        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v3
+        with:
+          sarif_file: hypatia.sarif
+          category: hypatia
+
       - name: Run panic-attack assail
         run: |
           if command -v panic-attack >/dev/null 2>&1; then