ci(workflow): adopt hardened hypatia-scan from hyperpolymath/hypatia#237 (#126)

* ci(workflow): adopt hardened hypatia-scan from hyperpolymath/hypatia#237

Replaces the local copy of `.github/workflows/hypatia-scan.yml` with the
canonical version from upstream main. The old copy had three issues that
combined to break every Dependabot PR:

1. `working-directory: \${{ env.HOME }}/hypatia\``, where `env.HOME`
   is not a GHA context — it evaluated to empty, so `cd /hypatia`
   failed and the scanner was never built.
2. `hypatia-cli.sh scan .` without `--exit-zero` — scanner exit-1 on
   findings short-circuited the rest of the step under `set -e`.
3. No baseline gate, so any pre-existing critical/high failed the build.

Upstream version:
- captures scanner exit code + stderr (visible on crash)
- falls back to `[]` on missing/invalid JSON
- reads `.hypatia-baseline.json` and fails only on NET-NEW critical/high
- scopes permissions narrowly (contents: read, pull-requests: write)
- marks the PR-comment step `continue-on-error: true` so Dependabot PRs
  (read-only token) don't fail on the unavoidable 403

Baseline file follows in a second commit on this branch — first we need
the new workflow to actually run and capture current findings.

Unblocks PR #125 (CODEOWNERS) which is stuck on this exact scan.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* ci(fixup): restore newlines in hypatia-scan.yml

Previous commit on this branch wrote the YAML as a single line due to a
PowerShell encoding/-NoNewline mistake on my end. This re-applies the
canonical workflow content byte-for-byte, with line breaks intact, so
GitHub Actions can parse it.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* ci(baseline): seed/refresh .hypatia-baseline.json from new workflow's first scan

Captured from run 25856297607 on this branch. 16 critical+high entries accepted as pre-existing baseline. Net-new findings going forward will still fail the gate.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

Author: hyperpolymath