fix(ci): close the governance gate — SPDX, permissions, SHA pins, reusable bump

[hyperpolymath]

The governance gate is all-jobs-must-pass, so these ship as one commit;
individually none of them turns the repo green.

• SPDX line-1 header and a top-level permissions: block on every
  workflow file (the two Workflow security linter checks).
• Every uses: tag reference resolved to a full 40-hex commit SHA. This
  satisfies the linter and also the repository's own
  sha_pinning_required Actions policy, which refuses @v4 at parse
  time — a refusal that produces no check run at all.
• hypatia-scan.yml now grants security-events: write. This is not
  cosmetic and is not separable from the pin bump below: at HEAD the
  reusable declares security-events: write where the old pin declared
  read, and a called workflow cannot escalate beyond its caller's
  grant. Bumping the pin without this would fail at parse time.
• The three reusables watched by the staleness gate (governance,
  hypatia-scan, scorecard) advanced to standards HEAD, which is 62
  commits ahead of the false-green cache fix and includes the
  deny-list-negative fix from standards#524.

mirror-reusable and secret-scanner-reusable are deliberately left on
their current pins: the staleness gate does not watch them, so they are
not holding anything red, and bumping them carries unrelated risk.

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com

[github-actions]

🔍 Hypatia Security Scan

Findings: 41 issues detected

Severity	Count
🔴 Critical	4
🟠 High	21
🟡 Medium	16

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Agda postulate assumes without proof -- potential soundness hole (1 occurrences, CWE-704)",
    "type": "agda_postulate",
    "file": "/home/runner/work/valence-shell/valence-shell/proofs/agda/FilesystemModel.agda",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "believe_me undermines formal verification (2 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/valence-shell/valence-shell/proofs/idris2/src/Filesystem/Axioms.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "Obj.magic bypassing type safety (2 occurrences, CWE-704)",
    "type": "obj_magic",
    "file": "/home/runner/work/valence-shell/valence-shell/impl/mcp/src/bindings/Mcp.res",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "JSON decode without validation (1 occurrences, CWE-20)",
    "type": "json_decode_no_validation",
    "file": "/home/runner/work/valence-shell/valence-shell/impl/mcp/src/Server.res",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "expect() in hot path (1 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/valence-shell/valence-shell/impl/rust-cli/src/external.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unsafe block -- requires SAFETY comment (6 occurrences, CWE-676)",
    "type": "unsafe_block",
    "file": "/home/runner/work/valence-shell/valence-shell/impl/rust-cli/src/external.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "from_raw constructs types from raw pointers without safety checks (4 occurrences, CWE-676)",
    "type": "from_raw",
    "file": "/home/runner/work/valence-shell/valence-shell/impl/rust-cli/src/external.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "expect() in hot path (1 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/valence-shell/valence-shell/impl/rust-cli/src/glob.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "expect() in hot path (1 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/valence-shell/valence-shell/impl/rust-cli/src/arith.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unsafe block -- requires SAFETY comment (2 occurrences, CWE-676)",
    "type": "unsafe_block",
    "file": "/home/runner/work/valence-shell/valence-shell/impl/rust-cli/src/process_sub.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence