fix(hypatia): triage all 15 findings — 8 at source, 7 baselined (closes the red gate) - #146

#147)

Follow-up to #146 — the one finding that survived. hypatia's
`unsafe_block` rule is a bare `unsafe\s*\{` regex
(`lib/rules/code_safety.ex`): it flags every unsafe block regardless of
documentation, so no SAFETY comment can ever satisfy it (the adjacency
fix in #146 was a no-op against a rule that never looks). The single
unsafe block in my-llvm is mandatory (inkwell declares `build_gep`
unsafe) and fully documented, so this uses the same scoped
`.hypatia-ignore` mechanism as the existing `coq_axiom`/`transmute`
keyword-match exemptions — a permanent fact should not be expiring
baseline debt. Upstream rule fix is a candidate for hypatia itself.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

…al (#148)

Closes out the my-lang session by recording current state in-repo (not
only in dev-notes) and fixing the documentation defects found while
doing it.

## The Justfile was parse-dead
`README.md` documented `just build` / `just test` as the quickstart.
Neither worked: a `//` C-style comment on line 2 made `just` reject the
**entire file** (`error: unknown start of token '.'`), so no recipe was
reachable — and every recipe was an `@echo` stub regardless. `just
verify` checked `.machine_read/` (a path that has never existed) and
swallowed every failure with `||`, so it always reported success.

Now: real cargo recipes, `-all` variants for the LLVM-dependent crate,
and a `verify` that exits non-zero. **Verified by running them** — `just
build` exits 0; `just test` reports **221 passing, 0 failing**.

*(Estate note: 143 of 751 Justfiles across the estate are parse-dead by
the same class of defect — 76× unindented shell blocks, 35× `//`
comments, 32× `Justfile`/`justfile` case collisions. Out of scope here;
recorded in dev-notes.)*

## For machines — `.machine_readable/6a2/STATE.a2ml`
- version `0.1.0` → `0.2.0` (was drifting from `Cargo.toml`)
- new `[security-posture]`: distinguishes **expiring baseline debt** (7
entries → 2026-10-27, #145) from **permanent scoped exemptions** (3,
each a rule-precision problem), plus upstream rule-fix candidates
- new `[toolchain]`; `known-local-limitation` records that `my-llvm`
needs system LLVM 21, so a bare workspace build failure is not misread
as a regression
- dialect model corrected: **solo ⊂ duet ⊂ ensemble**, with `me` an
outside projector — not four co-equal surfaces
- `superseded-branch` records the evidence that
`feat/stdlib-fs-env-format` is safe to delete

## For humans — README + CHANGELOG
Quickstart matches reality (incl. the my-llvm caveat); dialect
containment; measured test count (137+ → 221); governance/security
posture; `contractiles/` path corrected (it is under
`.machine_readable/`, not the repo root). CHANGELOG gains
Security/Fixed/Changed entries for #143, #146, #147.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

… path real

The README documented `just build` / `just test` as the quickstart, but the
Justfile was PARSE-DEAD — a `//` C-style comment on line 2 made `just` reject
the whole file (`error: unknown start of token '.'`), so no recipe was
reachable; and every recipe was an `@echo` stub anyway. `just verify` checked
a `.machine_read/` path that has never existed and swallowed failures with
`||`, so it always claimed success.

Justfile: real cargo recipes (build/test/lint/fmt/check/proofs/pipeline),
split `-all` variants for the LLVM-dependent crate, and a `verify` that exits
non-zero when a path is missing. Parse- and run-verified: `just build` exits 0,
`just test` reports 221 passing / 0 failing.

STATE.a2ml (machines): version 0.1.0 -> 0.2.0 to match Cargo.toml; current
session + maintenance status; a new [security-posture] section distinguishing
EXPIRING baseline debt from PERMANENT scoped exemptions, with the three active
exemptions and their rule-precision rationale, plus upstream rule-fix
candidates; a [toolchain] section; the my-llvm/LLVM-21 local limitation
recorded so a bare workspace build failure is not misread as a regression; and
the dialect model corrected from four co-equal surfaces to solo ⊂ duet ⊂
ensemble with me as an outside projector.

README (humans): quickstart now matches reality incl. the my-llvm caveat;
dialect containment; measured test count (137+ -> 221); governance/security
posture; `.machine_readable/` and `_exploratory/` documented, and the
`contractiles/` path corrected (it is not at the repo root).

CHANGELOG: Security / Fixed / Changed entries for #143, #146, #147.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>