fix(shim): harden PseudoScript shim discovery + pin canonical

[hyperpolymath]

Hardens the bin/pseudo shim (discovery: $AFFINESCRIPT → PATH → sibling checkout, actionable not-found message) and adds .affinescript-pin (canonical commit lock).

Part of Milestone A of the face-sealing plan. Binding contract: docs/specs/FACE-CONTRACT.adoc in hyperpolymath/affinescript (PR #685). Draft — lands after the contract PR is reviewed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

🔍 Hypatia Security Scan

Findings: 16 issues detected

Severity	Count
🔴 Critical	0
🟠 High	9
🟡 Medium	7

View findings

[
  {
    "reason": "Issue in push-email-notify.yml",
    "type": "missing_timeout_minutes",
    "file": "push-email-notify.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Repository has 14 non-main remote branch(es). Policy: single main branch only.",
    "type": "GS007",
    "file": ".",
    "action": "delete_remote_branches",
    "rule_module": "git_state",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Scorecard): BranchProtectionID -- Branch-Protection -- 13 day(s) old [STALE]",
    "type": "CSA001",
    "file": "no file associated with this alert",
    "action": "escalate",
    "rule_module": "code_scanning_alerts",
    "severity": "high"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/workflow_audit/missing_timeout_minutes -- Hypatia workflow_audit: missing_timeout_minutes -- 13 day(s) old",
    "type": "CSA001",
    "file": "push-email-notify.yml",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Scorecard): FuzzingID -- Fuzzing -- 20 day(s) old",
    "type": "CSA001",
    "file": "no file associated with this alert",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Scorecard): SASTID -- SAST -- 20 day(s) old",
    "type": "CSA001",
    "file": "no file associated with this alert",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Scorecard): MaintainedID -- Maintained -- 20 day(s) old [STALE]",
    "type": "CSA001",
    "file": "no file associated with this alert",
    "action": "escalate",
    "rule_module": "code_scanning_alerts",
    "severity": "high"
  },
  {
    "reason": "Code scanning (Scorecard): CodeReviewID -- Code-Review -- 20 day(s) old [STALE]",
    "type": "CSA001",
    "file": "no file associated with this alert",
    "action": "escalate",
    "rule_module": "code_scanning_alerts",
    "severity": "high"
  },
  {
    "reason": "Code scanning (Scorecard): TokenPermissionsID -- Token-Permissions -- 20 day(s) old [STALE]",
    "type": "CSA001",
    "file": ".github/workflows/hypatia-scan.yml",
    "action": "escalate",
    "rule_module": "code_scanning_alerts",
    "severity": "high"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/git_state/GS007 -- Hypatia git_state: GS007 -- 48 day(s) old [STALE]",
    "type": "CSA001",
    "file": ".",
    "action": "update",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence