fix(ci): green the 8-week ClusterFuzzLite red, correct a 2-major-version pin comment, re-key a stale audit path (#201)

fix(ci): green the 8-week ClusterFuzzLite red, correct a 2-major-version
pin comment, re-key a stale audit path

Four independent hygiene fixes, each measured rather than assumed.

**ClusterFuzzLite batch fuzzing has failed every week since at least
2026-06-07** (06-07, 06-14, 06-21, 06-28, 07-05, 07-12, 07-19, 07-26).
It is `schedule:`-triggered, so it never appeared on the main-branch
push board and the 2026-07-21 sweep — which measured push-on-main only
— did not see it. The `address` leg passes; the `undefined` leg dies at
"Build Fuzzers (undefined)" with:

    cargo fuzz build --release --sanitizer=undefined fuzz_octad_id
    error: invalid value 'undefined' for '--sanitizer <SANITIZER>'
      [possible values: address, leak, memory, thread, none]

cargo-fuzz has no UBSan option, so this combination can never work for a
Rust project. `cflite_pr.yml` was already corrected to `[address]`; the
batch variant was missed. Dropping `undefined` is the honest fix —
`thread`/`leak` are valid for Rust and can be added deliberately later.

**The CodeQL pin comment was wrong by two major versions.** The pinned
SHA e4fba868 is real and is upstream tag **v4.37.3**, but both `uses:`
lines annotated it `# v3.28.1`. A pin comment that misstates the version
defeats the audit purpose of SHA pinning, since reviewers read the
comment, not the hash.

Note for the record: an unpushed local commit proposed re-pinning these
to 29b1f65c1f735799893313399435a59f54045865. That SHA **does not exist**
in github/codeql-action (the API returns 422), so it was dropped rather
than salvaged.

**A stale audit key was re-firing the only High-severity finding in the
scan.** `audits/assail-classifications.a2ml` keyed
`connectors/clients/rescript/src/VeriSimVql.res`; the VCL rename moved
that file to `VeriSimVcl.res` and the classification never followed, so
its `UnsafeDeserialization` finding was unsuppressed. Every
classification
key in the file now resolves to an existing path.

**push-email-notify.yml removed** per the estate ruling that retains
push-email only in 007, robodog-defensive-systems-lab and
defensive-multiplicity. It was already `disabled_manually` and no
variable or secret references it.

Also adds local-noise entries to `.gitignore` (db files, caches, agent
worktrees, export/build outputs). Deliberately does **not** ignore
`.editorconfig`: it is tracked, annotated in `REUSE.toml`, and checked
by the governance `quality` job's editorconfig-checker.

Verified: `reuse lint` 775/775 compliant, zero unused licences;
`tests/doc-consonance-gate.sh` passes; both edited workflows parse as
YAML. The one `validate-a2ml.sh` error on this file is **pre-existing on
origin/main** — byte-identical output with and without this change.

Author: hyperpolymath

.github/workflows/cflite_batch.yml

@@ -14,7 +14,14 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        sanitizer: [address, undefined]
+        # `undefined` is NOT a valid cargo-fuzz sanitizer. cargo-fuzz accepts
+        # only address/leak/memory/thread/none, so the UBSan leg failed at
+        # "Build Fuzzers (undefined)" every week from at least 2026-06-07 to
+        # 2026-07-26 with:
+        #   error: invalid value 'undefined' for '--sanitizer <SANITIZER>'
+        # It is schedule-triggered, so it never showed on the main-branch
+        # board. cflite_pr.yml was already corrected; this file was missed.
+        sanitizer: [address]
     steps:
       - name: Build Fuzzers (${{ matrix.sanitizer }})
         id: build

.github/workflows/codeql.yml

@@ -39,12 +39,12 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3.28.1
+        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3.28.1
+        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/push-email-notify.yml

@@ -114,3 +114,19 @@ ai-cli-crash-capture/
 # Fuzz harness build artifacts
 fuzz/target/
 rust-core/fuzz/target/
+
+# Local database files
+*.db
+*.db-journal
+*.db-shm
+*.db-wal
+
+# Local caches and agent worktrees
+.cache/
+.claude/
+
+# Local export and build outputs
+/exports/*.json
+/exports/*.lgt
+composer/*.beam
+composer/build/

.gitignore

@@ -30,7 +30,7 @@
   ;; inside `try { } catch` returning result<_, VeriSimError.t>. The
   ;; graceful degradation the finding asks for is already present.
   (classification
-    (file "connectors/clients/rescript/src/VeriSimVql.res")
+    (file "connectors/clients/rescript/src/VeriSimVcl.res")
     (category "UnsafeDeserialization")
     (audit "try-wrapped stringify→parseExn round-trips")
     (rationale "parse of self-stringified JSON inside try; cannot throw on external input"))