fix(governance): pin Hypatia baseline, warn≡medium, self-fresh lock gate

[hyperpolymath]

Follow-up to #1120. It clears the two remaining reds on main.

Validate Hypatia Baseline (red on main):

• hypatia#895 maps severity warn to medium. Since then, the 20 RE001/RE005 acknowledgements in .hypatia-baseline.json (recorded as warn) no longer match, so every caller whose baseline has warn entries breaks.
• scripts/apply-baseline.sh now treats warn and medium as one tier.
• Measured on the failing run's 20 kept findings: 20 suppressed, 0 kept.
• New tests: warn↔medium matches in both directions, and a different tier stays unmatched. Main's matcher fails both new positive cases (mutant).
• The governance-reusable baseline job also floated on hypatia HEAD. It now pins through a hypatia-ref input (default 51ab6496). HEAD remains accepted as an explicit opt-in for canaries.

Repo self-tests (red on main):

• The lock gate staged standards at a hardcoded third pin (5f82b635). That pin was one change behind by construction and went stale again with ci: drop embedded Python YAML parsing; gate inline Python #1119.
• It now stages at ${{ job.workflow_sha }}, the reusable's own commit, which is exactly what the caller pinned.
• check-lock-gate-pin-freshness.sh and both contract tests accept that expression. They still refuse github.workflow_sha/github.sha, which name the caller's commit (planted negatives: all three guards go red).

Package policy: a caller pinned before the capability resolver existed now gets a warning and is treated as undeclared, instead of failing.

Local: run-shell-test-suite.sh, all 69 files pass. docstring-scan --check passes.

🤖 Generated with Claude Code

https://claude.ai/code/session_016L7GFo3yGQ2vK9YgKL2wsP

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 40 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 1c2ae882-b023-4d87-baf9-815a3a6ccd0c

📥 Commits

Reviewing files that changed from the base of the PR and between 721e4a9 and 78f7758.

📒 Files selected for processing (9)

• .github/workflows/governance-reusable.yml
• scripts/apply-baseline.sh
• scripts/check-lock-gate-pin-freshness.sh
• scripts/check-package-policy.sh
• scripts/tests/apply-baseline-test.sh
• scripts/tests/check-lock-gate-pin-freshness-test.sh
• scripts/tests/governance-gates-505-test.sh
• scripts/tests/governance-reusable-contract-test.sh
• tests/test_governance_reusable_shape.sh

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}