fix(ci): Security Scan called a repo name that no longer exists (#188)

## The bug

`.github/workflows/security-scan.yml` called
`hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml`.

**That repo no longer exists.** It was renamed to
`hyperpolymath/panic-attack`.

GitHub's REST API transparently follows repository renames. **GitHub
Actions does not** — not when resolving a reusable workflow's `uses:`.
The call fails at workflow *load* time.

## Why it took so long to characterise

The failure fingerprint is unusually opaque, and every diagnostic came
back clean *because* of the redirect:

| Probe | Result | Why it misled |
|---|---|---|
| `gh api repos/.../panic-attacker/contents/...?ref=<pin>` | file
returned | API followed the rename |
| `compare/main...<pin>` | `ahead_by: 0, behind_by: 37` | API followed
the rename |
| reusable's declared `permissions` | `contents: read`, matches caller |
not the cause |
| repo `allowed_actions` | `all` | not the cause |
| `actionlint` on the caller | exit 0 | can't resolve remote `uses:` |

And the run itself gives you nothing:

- `conclusion: failure` — **not** `startup_failure`, so the usual
caller-under-grant playbook doesn't apply
- `total_count: 0` jobs, zero check-runs
- `gh run view --log` → `failed to get run log: log not found`
- `gh run view` (plain) → only *"This run likely failed because of a
workflow file issue."*

The decisive tell is in the **workflow registry**: GitHub falls back to
showing the file path as the workflow `name` when it has never
successfully parsed the file.

```
active  [ghcr-publish]                            .github/workflows/ghcr-publish.yml
active  [Secret Scanner]                          .github/workflows/secret-scanner.yml
active  [.github/workflows/security-scan.yml]     .github/workflows/security-scan.yml   <-- never parsed
```

The estate split confirms it: **verisimdb** and **ambientops** point at
the dead name and show the unparsed path-as-name; **echidna** points at
the live name, parses fine, and runs a real job.

## The fix

- `panic-attacker` → `panic-attack`
- pin `2dc1393c` (2026-05-20) → `efe9982f` (2026-07-19), which adds the
upstream *skip-dispatch-without-PAT* branch and oversized-payload
chunking
- add a `concurrency` group matching the repo's other callers

## Verification

This workflow triggers on `push: [main]` + schedule + dispatch only, so
a fix to it can never be seen on a PR. A **temporary `pull_request:`
trigger** is included so the load fix is proven by a real run here; it
is removed in a follow-up commit on this branch before merge.

- `actionlint .github/workflows/security-scan.yml` → exit 0
- `reuse lint` → 773/773 compliant
- `cargo test -p verisim-octad --test integration_tests` → **7 passed; 0
failed; 0 ignored**

## Known follow-on — NOT fixed here (owner action)

**`VERISIMDB_PAT` is expired.** Once the reusable actually resolves, the
scan will run and then fail at the cross-repo dispatch to
`verisimdb-data`. Proof, from echidna's run
[29687503416](https://github.com/hyperpolymath/echidna/actions/runs/29687503416)
— which already reaches this point:

```
Full report 275619 bytes exceeds dispatch cap; sending summary
##[error]verisimdb-data dispatch failed with HTTP 401: {
  "message": "Bad credentials",
```

So expect this PR's Security Scan run to be **red at the dispatch step,
with a visible log** — that is the *success* condition here: it means
the workflow now loads and the scan executes. Rotating the secret is the
remaining step and only the owner can do it.

## Also in this PR

`rust-core/verisim-octad/tests/integration_tests.rs` carried a module
doc claiming persistence tests were `#[ignore]`d. They were removed in
`ee3e902`; there are no `#[ignore]`d tests anywhere in the workspace.

## Sibling repo affected

`hyperpolymath/ambientops` has the identical dead-name bug (same
unparsed registry entry). Not touched here.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/security-scan.yml

@@ -5,15 +5,39 @@ name: Security Scan
 on:
   push:
     branches: [main]
+  # No `pull_request:` trigger by design -- this scan pushes a report to
+  # verisimdb-data, which should happen for main, not for every PR. That does
+  # mean a change to THIS file cannot be verified pre-merge; a temporary
+  # `pull_request:` trigger was added on this branch to prove the fix below,
+  # then removed. Verifying run: 29831433656 (commit 4cd3f20) -- the workflow
+  # loaded, the scan executed, and only the dispatch step failed (HTTP 401,
+  # expired VERISIMDB_PAT). Re-add the trigger the same way if you touch this.
   schedule:
     - cron: '0 0 * * 0'  # Weekly on Sunday at midnight
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
 jobs:
   scan:
-    uses: hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml@2dc1393c0ac982dbad98ba07f78a580d319456a5 # main 2026-05-20
+    # `hyperpolymath/panic-attacker` NO LONGER EXISTS: the repo was renamed to
+    # `hyperpolymath/panic-attack`. The REST API transparently follows repo
+    # renames, so every API probe of the old name appears to succeed — but
+    # GitHub Actions does NOT follow renames when resolving a reusable
+    # workflow's `uses:`. The call therefore failed at workflow-LOAD time,
+    # which is why every run since at least 2026-07-14 reported
+    # `conclusion: failure` with zero jobs, no retrievable log, and this
+    # workflow's registry entry stuck showing the file path instead of
+    # "Security Scan" (GitHub never parsed the file).
+    #
+    # Pin refreshed at the same time: the previous pin (2dc1393c, 2026-05-20)
+    # predates the upstream fix that skips the cross-repo dispatch when
+    # VERISIMDB_PAT is absent and that chunks oversized payloads.
+    uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@efe9982f245e1e7af6258d55a9424b6a8ad2d9a5 # main 2026-07-19
     secrets:
       VERISIMDB_PAT: ${{ secrets.VERISIMDB_PAT }}

rust-core/verisim-octad/tests/integration_tests.rs

@@ -3,7 +3,11 @@
 //! Integration tests for VeriSimDB
 //!
 //! Tests cross-modal consistency and end-to-end workflows.
-//! Persistence tests are gated behind `#[ignore]` until store serialization is implemented.
+//!
+//! There are no `#[ignore]`d tests here. Disk persistence is not a property of
+//! the in-memory stores this file exercises; it lives in the sibling
+//! `Persistent*` variants (`verisim-{vector,tensor,semantic,temporal}/src/persistent.rs`)
+//! and is covered by unit tests there. See the note above `test_modality_isolation`.
 
 use std::sync::Arc;
 use verisim_document::TantivyDocumentStore;