[e] Catch-all: repo hygiene + workflow-audit backlog

[hyperpolymath]

Catch-all for the smaller "everything else" (scope e). Mostly surfaced by the Hypatia advisory scan on #196 plus the standing audit.

Hygiene / workflow audit

• Stale AI session file GEMINI.md → delete (hypatia root_hygiene).
• Unpinned actions: e2e.yml (upload-artifact), governance.yml (reusable @main) → pin to SHA.
• Missing timeout-minutes: abi-drift.yml, codeql.yml, container-publish.yml, dogfood-gate.yml (×several); several missing concurrency.
• python3 usage vs the no-Python policy: lsp-dap-bsp.yml, fuzz.yml.
• Committed build artifacts → gitignore: src/abi/build/ttc/** (.ttc/.ttm), **/zig-out/**, committed *.so.

Two broken CI gates (pre-existing; surfaced on #196, both in lsp-dap-bsp.yml)

• Zig install uses curl ziglang.org/builds/zig-linux-x86_64-0.15.2.tar.xz → error page (xz: File format not recognized). Released Zig is under /download/<ver>/, not /builds/. Switch to the goto-bus-stop/setup-zig action (as e2e.yml does) or fix the URL.
• ABI Specification Check false-positive (the believe_me|assert_total|sorry grep matches README.adoc) — fix also tracked from scopes a/b.

Legal / versioning (P0-ish)

• License drift: package.json says AGPL-3.0-or-later vs MPL-2.0 everywhere else — reconcile (legal).
• Version drift 0.4.6 vs 0.4.7 across CITATION.cff, smithery.yaml, package.json, jsr.json, gemini-extension.json, glama.json.

Pick off opportunistically or hand to a background agent.

---

Filed via Claude Code · https://claude.ai/code/session_019tMcRS1Dm1nWjjYP4WvbJa