fix(ci): restore baseline validation gates

[hyperpolymath]

Summary

Restore the three validation workflows that were red on main after #189:

• give audits/assail-classifications.a2ml the identity, version, and SPDX metadata required by the repository A2ML validator
• replace all ten invalid Hypatia /issues/pending placeholders with the existing standards campaign hyperpolymath/developer-ecosystem#111
• re-pin the reusable secret scanner to standards commit 5b5dab9f, which stages the estate baseline, asserts it is non-empty, passes the selected config explicitly to gitleaks, and covers the AsciiDoc blind spot
• add a planted-negative Dogfood control proving an empty A2ML document is rejected for the expected identity error

Validation

• full A2ML horizon: 3,857 files scanned, 0 errors (316 existing non-strict warnings)
• targeted audit validation: 1 file, 0 errors, 0 warnings
• planted empty A2ML fixture: rejected as expected
• planted invalid Hypatia tracking_issue: rejected; all ten repaired entries accepted by the required owner/repo#N shape
• local gitleaks repository scan using the staged estate baseline: passed
• planted redacted gitleaks canary: detected and rejected
• jq empty .hypatia-baseline.json
• hooks/validate-spdx.sh
• just validate-bot-directives
• git diff --check

Scope

This PR repairs the existing repository baselines and workflow integration only. It does not include the remaining issue #117 satellite renames or alter the substantive suppression entries.

[gitar-bot]

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

_Gitar