sweep-classifiers: four scripts default INPUT/BLOBS_DIR to a fixed /tmp/drift-survey path (hardcoded_tmp) #1243

Defect

The four survey classifiers under scripts/sweep-classifiers/ default their input and blob directories to a fixed path under /tmp, which Hypatia content_patterns/hardcoded_tmp flags (CWE-377 class). The findings have been acknowledged in .hypatia-baseline.json since 2026-09-22 with the note "pending a mktemp conversion pass"; PR #1072's mktemp pass covered other scripts and missed these. Their previous tracker (#936) is closed, so this issue is the live tracker the acks point at.

Evidence

$ grep -n '/tmp/drift-survey' scripts/sweep-classifiers/*.sh
scripts/sweep-classifiers/classify-codeql.sh:19:INPUT="${1:-/tmp/drift-survey/codeql-full.json}"
scripts/sweep-classifiers/classify-codeql.sh:20:BLOBS_DIR="${BLOBS_DIR:-/tmp/drift-survey/codeql-blobs}"
scripts/sweep-classifiers/classify-hypatia-scan.sh:21:INPUT="${1:-/tmp/drift-survey/hypatia-scan-full.json}"
scripts/sweep-classifiers/classify-hypatia-scan.sh:22:BLOBS_DIR="${BLOBS_DIR:-/tmp/drift-survey/hypatia-blobs}"
scripts/sweep-classifiers/classify-mirror.sh:24:INPUT="${1:-/tmp/drift-survey/mirror-full.json}"
scripts/sweep-classifiers/classify-mirror.sh:25:BLOBS_DIR="${BLOBS_DIR:-/tmp/drift-survey/blobs}"
scripts/sweep-classifiers/classify-secret-scanner.sh:22:INPUT="${1:-/tmp/drift-survey/secret-scanner-full.json}"

Baseline entries (4): hardcoded_tmp on each of the four files, expires_at 2026-12-22, tracking_issue this issue.

Expected

One of:

1. Require the input path as an argument (no /tmp default) and derive BLOBS_DIR with mktemp -d or from ${XDG_RUNTIME_DIR:-${TMPDIR:-/tmp}} as the launcher standard does; or
2. Archive the four scripts under 9-archive/ if the 2026-09 drift survey is finished (they read a one-off survey dump); or
3. Record the default as intentional with an inline # hypatia: allow content_patterns/hardcoded_tmp -- <reason> on each line, and drop the four baseline acks.

Option 2 is the elegant arm if the survey is not re-run: the scripts are dated tooling, not gates. Owner's call between 1 and 2.

Propagation

Repo-local. No estate copies.

Context: packet P1.1 of docs/reorg/2026-10-14-tidy/README.adoc (re-acking the entries expiring 2026-10-21); supersedes #936 as the tracker for these four acks.