build(deps): Bump hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml from 897159a4e7392eb2be76630c5c5d3c1132cce040 to ea88be7da68e07249ae7df8b948ecb8ecfb9664c in the actions group (#69)

Bumps the actions group with 1 update:
[hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml](https://github.com/hyperpolymath/panic-attacker).

Updates
`hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml`
from 897159a4e7392eb2be76630c5c5d3c1132cce040 to
ea88be7da68e07249ae7df8b948ecb8ecfb9664c
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/hyperpolymath/panic-attack/blob/main/CHANGELOG.md">hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>[Unreleased] — 2026-04-18</h2>
<h3>Added</h3>
<ul>
<li><strong>User-classification registry</strong>
(<code>assail::UserClassification</code>,
<code>load_user_classifications</code>,
<code>apply_user_classifications</code>): panic-attack
now reads an optional project-local classification file at every assail
pass and flips matching findings to <code>suppressed = true</code> after
the kanren
structural-suppression pass. Two lookup paths:
<ul>

<li><code>&lt;project_root&gt;/audits/assail-classifications.a2ml</code>
(preferred)</li>

<li><code>&lt;project_root&gt;/.panic-attack-classifications.a2ml</code>
(fallback)
File format is a simple A2ML S-expression with <code>(classification
(file …) (category …) (audit …) (rationale …))</code> blocks;
<code>;;</code> line comments
ignored. The registry pattern lets repositories record audited findings
out-of-band from the source under scan so a PR adding a new unsafe
block cannot self-suppress without a reviewable companion edit to
the registry.</li>
</ul>
</li>
<li><strong>Rocq scaffold classifier</strong> (<code>analyze_coq</code>
+
<code>count_rocq_unverified_postulates</code> +
<code>is_rocq_abstraction_parameter</code>):
the Rocq detector no longer counts Section-scoped <code>Variable</code>
/
<code>Hypothesis</code> / <code>Parameter</code> declarations (they
discharge at <code>End Section</code>) and classifies module-level
<code>Parameter</code> declarations by
stated type: carrier types (<code>Type</code>, <code>Set</code>),
decidability witnesses
(<code>forall _, { _ = _ } + { _ &lt;&gt; _ }</code>), and function
types with a
concrete non-Prop codomain are treated as abstraction parameters.
Prop-valued declarations (classical excluded-middle, choice,
unresolved theorem statements) remain counted. Removes the
false-positive stream that surfaced on every canonical-proof-suite
scaffold.</li>
</ul>
<h3>Changed</h3>
<ul>
<li><strong>Suppression pipeline</strong>: <code>analyze()</code> and
<code>analyze_verbose()</code> now
chain <code>apply_suppression</code> →
<code>apply_user_classifications</code> in that
order; the explicit post-analyze calls in <code>assail::analyze</code>
and
<code>assail::analyze_verbose</code> at the module boundary are retained
for
API-contract clarity but are no-ops when an <code>Analyzer</code> pass
has
already run.</li>
<li><strong>Rocq test coverage</strong>: 12 new unit tests across
<code>analyzer.rs</code>
(Section-scoped Variables / module-level Type carriers / decidable
equality / concrete-codomain functions / Prop-valued axioms /
missing type annotation / full scaffold shape — 7 tests) and
<code>mod.rs</code> (missing-registry / single-entry / multiple-entry /
comment handling / end-to-end suppression-flip — 5 tests).</li>
</ul>
<h3>Verified</h3>
<ul>
<li>007 canonical-proof-suite scan: active finding count <strong>8 →
0</strong>
(the 6 scaffold ProofDrifts via the detector enhancement, the 2
<code>zig_bridge.rs</code> UnsafeCode findings via the classification
registry
pointing at <code>audits/audit-ffi-unsafe.md §1</code>). No
in-source</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/ea88be7da68e07249ae7df8b948ecb8ecfb9664c"><code>ea88be7</code></a>
ci(hypatia-scan): repin reusable to merge-commit SHA (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/81">#81</a>)</li>
<li>See full diff in <a
href="https://github.com/hyperpolymath/panic-attacker/compare/897159a4e7392eb2be76630c5c5d3c1132cce040...ea88be7da68e07249ae7df8b948ecb8ecfb9664c">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Author: dependabot[bot]

.github/workflows/security-scan.yml

@@ -14,6 +14,6 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml@897159a4e7392eb2be76630c5c5d3c1132cce040 # main 2026-05-20
+    uses: hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml@ea88be7da68e07249ae7df8b948ecb8ecfb9664c # main 2026-05-20
     secrets:
       VERISIMDB_PAT: ${{ secrets.VERISIMDB_PAT }}