feat(sweep-tracker): hierarchical estate-sweep Markdown report

[hyperpolymath]

Summary

Adds panic-attack sweep-tracker subcommand — an issue-#32-shaped sweep
tracker derived from the per-finding (issue #33 S1) and campaign-state
(issue #33 S2) hexad stores. Complements (does not replace) the existing
per-finding campaign status table.

Distinct from campaign status:

• Hierarchical, not flat — grouped by repo and/or by category.
• Estate summary header: total findings, repos, criticals, highs,
  PR-filed, dismissed, open-no-PR.
• Always sourced from the finding store: a finding with no campaign
  hexad still appears (state open); campaign status shows only
  rows with a campaign event.

CLI

panic-attack sweep-tracker [--verisimdb-dir DIR] [--output FILE]
                          [--by-repo | --by-category]

No flag = both sections. --by-repo / --by-category select one
section only (mutually exclusive via clap arg group).

Output shape

# Estate sweep tracker

_Generated <ISO>_

**Estate summary**: N findings across R repos (C critical, H high).
M PR-filed, D dismissed, U open (no PR).

## By repo

### alpha (2 findings, 1 critical)
- [x] PA001 src/lib.rs:23 — pr-merged ([#42](https://github.com/...))
- [ ] PA004 src/ffi.rs:7  — open
...

Determinism

• Repos sorted alphabetically.
• Findings within each repo sorted by (rule_id, file, line, finding_id).
• Categories sorted by rule_id.

Implementation

• New module src/sweep_tracker/ with public render_report(base_dir, shape) and ReportShape::{ByRepo, ByCategory, Both} (default Both).
• Reuses storage::load_finding_hexads / storage::load_campaign_hexads
  — no new I/O paths.
• New CLI variant Commands::SweepTracker wired in src/main.rs.
• 7 unit tests (1 extra above the spec floor of 5):
  empty-store, by-repo grouping, by-category grouping, campaign-state
  join (open / pr-merged / dismissed), deterministic ordering,
  both-shape ordering, PR-number label parser.

Notes on base

This PR depends on issue-#33 S1 (feat/issue-33-s1-finding-hexads,
PR #55) and S2 (feat/issue-33-s2-campaign-state, PR #56) for the
loaders and CampaignSemantic type. Branched off the S2 tip so the
diff is minimal; base is main as standing policy. Once #55 and #56
land this PR's diff will narrow to just src/sweep_tracker/ plus the
small wiring delta in src/lib.rs + src/main.rs.

Test plan

• cargo test --lib — 227 tests pass, including 7 new sweep_tracker tests
• cargo clippy --all-targets -- -D warnings clean
• cargo fmt --all -- --check clean
• Smoke-test against a real verisimdb-data/ produced by an
  assemblyline run with PANIC_ATTACK_STORE_FINDING_HEXADS=1

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 46 issues detected

Severity	Count
🔴 Critical	5
🟠 High	16
🟡 Medium	25

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Nickel file missing SPDX-License-Identifier header (1 occurrences, CWE-1104)",
    "type": "ncl_missing_spdx",
    "file": "/home/runner/work/panic-attack/panic-attack/reports/panic-attack-20260211180017.ncl",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (1 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/panic-attack/panic-attack/src/sweep_tracker/mod.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "expect() in hot path (2 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/panic-attack/panic-attack/src/attestation/chain.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (1 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/panic-attack/panic-attack/src/attestation/evidence.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (1 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/panic-attack/panic-attack/src/ambush/mod.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (3 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/panic-attack/panic-attack/src/kanren/strategy.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (3 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/panic-attack/panic-attack/src/axial/mod.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "expect() in hot path (4 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/panic-attack/panic-attack/src/assail/analyzer.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unwrap() without prior check -- DoS via panic (4 occurrences, CWE-754)",
    "type": "unwrap_without_check",
    "file": "/home/runner/work/panic-attack/panic-attack/benches/scan_bench.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence