ci(hypatia-scan): repin orphan reusable SHA — finish #140's intent

[hyperpolymath]

Summary

PR #140 ("repin orphan reusable SHAs (97df7621/4fdf4314 → live)") was
filed to repin both rust-ci.yml and hypatia-scan.yml away from
orphan pins, per its description:

• hypatia-scan-reusable.yml@97df7621 → @915139d73560e65a8240b8fc7768698658502c89
• rust-ci-reusable.yml@4fdf4314 → @cc5a372af1af1b202c17f1b21efd954e6c038bef

…but the merged diff only touched rust-ci.yml. hypatia-scan.yml
line 28 was never updated.

Result: the Hypatia Security Scan workflow has been completing as
failure with zero jobs on every push to main since #140
merged — workflow_call refuses orphan SHAs and emits "workflow file
issue" with no jobs created (exactly the pattern #140's description
named).

Verification

git merge-base --is-ancestor 97df7621... origin/main → NOT ancestor (orphan)
git merge-base --is-ancestor 915139d7... origin/main → ancestor (behind by 56)

Why this PR exists separately

It applies the SECOND half of #140's stated fix, no other changes.
The first half (rust-ci.yml) shipped in #140 and is working as
intended (cc5a372 confirmed as ancestor of standards/main).

Refs #140.

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 205 issues detected

Severity	Count
🔴 Critical	12
🟠 High	80
🟡 Medium	113

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in agda-meta-checker.yml",
    "type": "missing_timeout_minutes",
    "file": "agda-meta-checker.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in boj-build.yml",
    "type": "missing_timeout_minutes",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in cargo-audit.yml",
    "type": "missing_timeout_minutes",
    "file": "cargo-audit.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in cflite_batch.yml",
    "type": "missing_timeout_minutes",
    "file": "cflite_batch.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in cflite_pr.yml",
    "type": "missing_timeout_minutes",
    "file": "cflite_pr.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in chapel-ci.yml",
    "type": "missing_timeout_minutes",
    "file": "chapel-ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in chapel-ci.yml",
    "type": "missing_timeout_minutes",
    "file": "chapel-ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in chapel-ci.yml",
    "type": "missing_timeout_minutes",
    "file": "chapel-ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in chapel-ci.yml",
    "type": "missing_timeout_minutes",
    "file": "chapel-ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence