Hypatia: setup-beam pin cannot map ImageOS=ubuntu24 — scanner never runs for any caller

[hyperpolymath]

Summary

hypatia-scan.yml fails for every caller on GitHub-hosted ubuntu-latest, because the
pinned erlef/setup-beam SHA predates ubuntu24 support. No caller can fix this locally —
the pin lives in the shared workflow.

Evidence

Run: hyperpolymath/gnpl → Hypatia Security Scan → job Hypatia Neurosymbolic Analysis
→ step Setup Elixir for Hypatia scanner:

##[error]Tried to map a target OS from env. variable 'ImageOS' (got ubuntu24), but failed.
If you're using a self-hosted runner, you should set 'env': 'ImageOS': ... to one of the
following: ['ubuntu18', 'ubuntu20', 'ubuntu22', 'win19', 'win22']

Pinned action: erlef/setup-beam@2f0cc07b4b9bea248ae098aba9e1a8a1de5ec24c
Requested: elixir-version: 1.19.4, otp-version: 28.3

Root cause

ubuntu-latest now resolves to Ubuntu 24.04, so the runner sets ImageOS=ubuntu24. The
pinned setup-beam revision has no mapping for that value and aborts before Elixir is
installed. The scanner never runs.

This is the SHA-pinning-defeats-upstream-fixes pattern: setup-beam fixed ubuntu24
support upstream, but the pin holds every caller at the pre-fix revision.

Suggested fix (either)

1. Bump the pin to a setup-beam revision with ubuntu24 in its OS map (preferred —
   keeps ubuntu-latest), or
2. Pin the runner to runs-on: ubuntu-22.04 as a stopgap, which matches the action's
   existing map.

Option 1 is preferable; option 2 only defers the problem to the next image rotation.

Scope

Affects every repository calling the Hypatia reusable workflow, not just gnpl.
Noticed while remediating hyperpolymath/gnpl#6.