putative-scripts: triage Hypatia findings (13× hardcoded_tmp, 3× SD022)

#300 imported the untriaged estate scripts into putative-scripts/. On that import, Hypatia raised 16 findings in the imported files:

putative-scripts/FINAL_COMPLETION_SUMMARY_2026-09-11.md:1: structural_drift: SD022
putative-scripts/FINAL_STATUS_REPORT_2026-09-11.md:1: structural_drift: SD022
putative-scripts/REMAINING_TASKS_COMPREHENSIVE_2026-09-11.md:1: structural_drift: SD022
putative-scripts/apply-ci-fixes-batched.sh:113: content_patterns: hardcoded_tmp
putative-scripts/apply-ci-fixes-batched.sh:124: content_patterns: hardcoded_tmp
putative-scripts/apply-fixes-clean.sh:18: content_patterns: hardcoded_tmp
putative-scripts/apply-fixes-clean.sh:47: content_patterns: hardcoded_tmp
putative-scripts/audit-language-ci-workflows.sh:32: content_patterns: hardcoded_tmp
putative-scripts/create-and-merge-prs.sh:19: content_patterns: hardcoded_tmp
putative-scripts/generate_token_permissions_fix_report.sh:6: content_patterns: hardcoded_tmp
putative-scripts/generate_token_permissions_fix_report.sh:7: content_patterns: hardcoded_tmp
putative-scripts/run-full-propagation-v2.sh:16: content_patterns: hardcoded_tmp
putative-scripts/run-full-propagation-v2.sh:22: content_patterns: hardcoded_tmp
putative-scripts/run-full-propagation-v2.sh:35: content_patterns: hardcoded_tmp
putative-scripts/run-full-propagation-v2.sh:60: content_patterns: hardcoded_tmp
putative-scripts/run-full-propagation.sh:18: content_patterns: hardcoded_tmp

Acceptance criteria

Each script listed with hardcoded_tmp is either deleted during triage, or moved to scripts/ / repo-scripts/ with its scratch paths replaced by mktemp -d (scratch) or ${XDG_STATE_HOME:-$HOME/.local/state}/<app>/ (state).
The three dated *_2026-09-11.md reports flagged SD022 (src/Gnosis/ reference) are deleted or moved to an archive location that Hypatia does not scan.
Hypatia reports no open alert under putative-scripts/, or the directory has been emptied.

🤖 Generated with Claude Code