fix(ci): Security Scan called a repo name that no longer exists

`hyperpolymath/panic-attacker` was renamed to `hyperpolymath/panic-attack`.
GitHub's REST API transparently follows repository renames; GitHub Actions
does NOT follow them when resolving a reusable workflow's `uses:`. The call
therefore failed at workflow-LOAD time on every run since at least
2026-07-14, with the fingerprint that made it so hard to characterise:

  * `conclusion: failure` (not `startup_failure`)
  * zero jobs, no check-run, `gh run view --log` -> "log not found"
  * the workflow's registry entry stuck at `.github/workflows/security-scan.yml`
    instead of "Security Scan", because GitHub never parsed the file

Because the API follows the redirect, every probe of the old name came back
clean: the reusable "existed" at its pin, the pin was "reachable", the
permissions "matched", the repo was "public". The estate split is the proof
-- verisimdb and ambientops point at the dead name and show the unparsed
path-as-name; echidna points at the live name, parses, and actually runs.

Also re-pins 2dc1393c (2026-05-20) -> efe9982f (2026-07-19), which adds the
upstream skip-dispatch-without-PAT branch and oversized-payload chunking,
and adds a `concurrency` group matching the other callers.

A temporary `pull_request:` trigger is included so this fix is verified by a
real run before merge; it is removed in a follow-up commit on this branch.

Known follow-on, NOT fixed here: `VERISIMDB_PAT` is expired. echidna's run
29687503416 proves it -- the dispatch to verisimdb-data returns HTTP 401
"Bad credentials". Rotating that secret is an owner action.

Separately: drop a stale module doc in verisim-octad's integration tests that
claimed persistence tests were `#[ignore]`d. They were removed in ee3e902;
there are no `#[ignore]`d tests anywhere in the workspace.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/security-scan.yml

@@ -5,15 +5,36 @@ name: Security Scan
 on:
   push:
     branches: [main]
+  # TEMPORARY (removed before merge): this workflow has no pull_request
+  # trigger, so a fix to it can never be verified pre-merge. Added so the
+  # reusable-resolution fix below is proven by an actual run on this PR.
+  pull_request:
   schedule:
     - cron: '0 0 * * 0'  # Weekly on Sunday at midnight
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
 jobs:
   scan:
-    uses: hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml@2dc1393c0ac982dbad98ba07f78a580d319456a5 # main 2026-05-20
+    # `hyperpolymath/panic-attacker` NO LONGER EXISTS: the repo was renamed to
+    # `hyperpolymath/panic-attack`. The REST API transparently follows repo
+    # renames, so every API probe of the old name appears to succeed — but
+    # GitHub Actions does NOT follow renames when resolving a reusable
+    # workflow's `uses:`. The call therefore failed at workflow-LOAD time,
+    # which is why every run since at least 2026-07-14 reported
+    # `conclusion: failure` with zero jobs, no retrievable log, and this
+    # workflow's registry entry stuck showing the file path instead of
+    # "Security Scan" (GitHub never parsed the file).
+    #
+    # Pin refreshed at the same time: the previous pin (2dc1393c, 2026-05-20)
+    # predates the upstream fix that skips the cross-repo dispatch when
+    # VERISIMDB_PAT is absent and that chunks oversized payloads.
+    uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@efe9982f245e1e7af6258d55a9424b6a8ad2d9a5 # main 2026-07-19
     secrets:
       VERISIMDB_PAT: ${{ secrets.VERISIMDB_PAT }}

rust-core/verisim-octad/tests/integration_tests.rs

@@ -3,7 +3,11 @@
 //! Integration tests for VeriSimDB
 //!
 //! Tests cross-modal consistency and end-to-end workflows.
-//! Persistence tests are gated behind `#[ignore]` until store serialization is implemented.
+//!
+//! There are no `#[ignore]`d tests here. Disk persistence is not a property of
+//! the in-memory stores this file exercises; it lives in the sibling
+//! `Persistent*` variants (`verisim-{vector,tensor,semantic,temporal}/src/persistent.rs`)
+//! and is covered by unit tests there. See the note above `test_modality_isolation`.
 
 use std::sync::Arc;
 use verisim_document::TantivyDocumentStore;