Hypatia Baseline red on main: 15 unbaselined findings (critical=3, high=2, medium=10) #905

governance / Validate Hypatia Baseline is red on main and on every PR head: "15 findings >= medium (critical=3, high=2, medium=10)", none matched by .hypatia-baseline.json.

Kept findings by file (job 112286863772, PR #903 head): security-policy.yml ×3, lib/hypatia/scanner_suppression.ex ×3, ci.yml ×2, quality.yml ×2, ffi/zig/src/main.zig ×2, build-gossamer-gui.yml ×1, tests.yml ×1, . (scorecard) ×1. Rule modules: workflow_audit, security_errors, code_safety, scorecard. None is in a file #903 changes.

Acceptance criteria

• Each kept finding is fixed, or carries a justified, expiring baseline entry.
• governance / Validate Hypatia Baseline is green on main.

Deferred from #903 under AGENTS §5c item 3.