ci(hypatia-scan): repin reusable to merge-commit SHA (orphan-SHA fix) (#90)

The `hypatia-scan.yml` wrapper landed in #66 pinned to
`97df762107501909f50bb770e9bc200b6c415600` — the SHA of the
hypatia-scan-reusable.yml commit on standards#193's feature branch.

After standards#193 was squash-merged into standards/main on 2026-05-26,
that feature-branch commit was orphaned (`gh api
repos/.../compare/main...97df762` reports `status: diverged, ahead_by:
1, behind_by: 24`). GitHub Actions cannot resolve reusable-workflow
references to orphaned commits, so every hypatia-scan run since #73
merged has failed at the workflow-parse stage with "This run likely
failed because of a workflow file issue" — the run JSON shows `jobs: []`
because no job is ever instantiated.

The required check `Hypatia Neurosymbolic Analysis` (per branch
protection on main) is therefore never produced, blocking every PR
including #72 (proof-debt items 1-8) and #74 (items 7+8 deepening).

Repin to `915139d73560e65a8240b8fc7768698658502c89`, the actual
merge-commit SHA on standards/main. File content at this SHA is
byte-identical to the orphan (`diff -q` returns empty), but the commit
is reachable from standards/main, so the GitHub Actions runner can
resolve it and the workflow's `scan` job actually instantiates.

Estate impact: ~250+ repos across hyperpolymath/* pin the same orphaned
SHA (verified via `gh search code "@97df762"`). This is a
typed-wasm-local fix; standards-side closure of the estate-wide sweep is
upstream work tracked separately under the reusables campaign
(standards#215 closure doc, hypatia#336-339 detection issues).

<!-- SPDX-License-Identifier: MPL-2.0 -->
## Summary

<!-- Briefly describe what this PR does and why. Link to related issues
with "Closes #N". -->

## Changes

<!-- List the key changes introduced by this PR. -->

-

## RSR Quality Checklist

<!-- Check all that apply. PRs that fail required checks will not be
merged. -->

### Required

- [ ] Tests pass (`just test` or equivalent)
- [ ] Code is formatted (`just fmt` or equivalent)
- [ ] Linter is clean (no new warnings or errors)
- [ ] No banned language patterns (no TypeScript, no npm/bun, no
Go/Python)
- [ ] No `unsafe` blocks without `// SAFETY:` comments
- [ ] No banned functions (`believe_me`, `unsafeCoerce`, `Obj.magic`,
`Admitted`, `sorry`)
- [ ] SPDX license headers present on all new/modified source files
- [ ] No secrets, credentials, or `.env` files included

### As Applicable

- [ ] `.machine_readable/STATE.a2ml` updated (if project state changed)
- [ ] `.machine_readable/ECOSYSTEM.a2ml` updated (if integrations
changed)
- [ ] `.machine_readable/META.a2ml` updated (if architectural decisions
changed)
- [ ] Documentation updated for user-facing changes
- [ ] `TOPOLOGY.md` updated (if architecture changed)
- [ ] `CHANGELOG` or release notes updated
- [ ] New dependencies reviewed for license compatibility (MPL-2.0 /
MPL-2.0)
- [ ] ABI/FFI changes validated (`src/interface/abi/` and
`src/interface/ffi/` consistent)

## Testing

<!-- Describe how you tested these changes. -->

## Screenshots

<!-- If applicable, add screenshots or terminal output demonstrating the
change. -->

Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath