chore: post-checkpoint hygiene + Hypatia follow-ups

[hyperpolymath]

Deferred echidnabot items from the 2026-06-13 estate checkpoint (hyperpolymath/echidna#238) plus actionable Hypatia scan findings. Each is entangled enough to want a deliberate pass.

Hygiene / checkpoint:

• STATE.a2ml last-updated bump — must land via the dual-truth mirror (.machine_readable/ changes go in both standalone and the echidna monorepo copy).
• Archive SESSION_SUMMARY_2026-01-29.md — it's listed in CANONICAL_SOURCE.md's standalone→fleet table; move + update that table.
• Contractile location asymmetry: dust/must/trust live only under root contractiles/, intend only under .machine_readable/contractiles/ — do a reference-safe move.
• TESTING-REPORT.scm — .scm→.a2ml deprecation check (estate rule, excepting guix.scm).

Hypatia findings:

• Stale SONNET-TASKS.md (root_hygiene) — delete/move (also in CANONICAL_SOURCE.md).
• echidnabot.yml curl|sh (download_then_run) — verify checksum/signature before exec.
• NB: Hypatia's missing_timeout_minutes on caller workflows (codeql/governance/hypatia-scan/mirror/rust-ci/scorecard/secret-scanner) is a false-positive — timeout-minutes is invalid on reusable-workflow (uses:) jobs. The one real gap (echidna-fuzz.yml) is fixed separately.

[hyperpolymath]

Full Hypatia finding set (PR #89 scan) — canonical record

Recording the complete current output so this issue is the home for it. 75 findings (11 critical / 20 high / 44 medium):

By-design — do NOT fix (dominates the "critical" count):

• proofs/coq/admitted_stub.v (admitted, CWE-704) + proofs/lean/sorry_stub.lean (sorry) — intentional dogfood-CI failures per CLAUDE.md.

Workflow hardening (workflow_audit):

• SONNET-TASKS.md stale (root_hygiene)
• echidnabot.yml curl|sh (download_then_run) — verify checksum before exec
• scorecard-enforcer.yml — scorecard_publish_with_run_step → split the publish job
• instant-sync.yml — secret_action_without_presence_gate (peter-evans/repository-dispatch)
• codeql.yml — codeql_missing_actions_language

Code-quality (code_safety, medium):

• expect() in hot path: src/api/rate_limit.rs, src/dispatcher/echidna_client.rs, src/scheduler/job_queue.rs (CWE-754)

Separately surfaced (not Hypatia): echidna-fuzz.yml Property/Assertion jobs (TokenEchidnaTest) fail fast at the solc/echidna install-or-run step (no echidna-results/ produced) — pre-existing, only runs when contracts/**/echidna/**/the workflow change. Worth a look when touching the fuzz lane.

Note: Hypatia's missing_timeout_minutes on caller workflows is a false-positive (timeout-minutes invalid on uses: jobs); the one real gap was fixed in #89.

---

Generated by Claude Code