Hypatia neurosymbolic scan is red on main (6 critical findings) — triage the findings artifact #45

Red on main (scheduled run https://github.com/hyperpolymath/vocarium/actions/runs/40146421109) and identically on PR #42, a docs-only change (https://github.com/hyperpolymath/vocarium/actions/runs/40472451472/job/122082557461: "Hypatia found 6 critical security issue(s) — blocking merge"; findings in the hypatia-findings artifact, https://github.com/hyperpolymath/vocarium/actions/runs/40472451472/artifacts/12719945873).

Recorded so #42 does not widen to address them. The findings need reading by someone with the artifact: either they are real (fix in src/store/) or they are the scanner misreading the pure-Zig store (file a baseline / allowlist per the governance / Validate Hypatia Baseline job). Not triaged from the Phase 0 session, which cannot download artifacts.

For contrast, the gate that proves the slice — vocarium-ci.yml "invoke-slice gate" (zig build test + tests/e2e/invoke_slice.sh under Zig 0.16.0) — is green on #42: https://github.com/hyperpolymath/vocarium/actions/runs/40472451463.