CI honesty sweep: local template checks that cannot fail + CodeQL Rust gap + contractile drift

[hyperpolymath]

CI honesty sweep — local template checks that cannot fail + gaps

From a full failure-path audit of nexia-list's 12 workflows (2026-07-17). The verdict test (per estate doctrine): can this check fail when something is actually wrong? The high-value fakes are template-shared and tracked upstream in hyperpolymath/standards (gitleaks → PR #500 merged; governance-reusable dead jobs → separate standards issue). This issue tracks the nexia-list-local items.

Local (copied) template checks that don't gate

• dogfood-gate.yml
  • Empty-linter: set +e, findings only ::warning:: → never fails.
  • Groove manifest check: annotations only, never exit.
  • Dogfooding compliance summary: if: always(), pure $GITHUB_STEP_SUMMARY echo (arguably OK as a non-gating summary — label it so).
  • REAL, keep: Validate A2ML manifests (exit 1 on errors even at strict:false); Validate K9 contracts (real but skips when k9_count==0; nexia has 0 K9 files).
• hypatia-scan.yml — findings NEVER gate: scan ... || true; "Check for critical issues" only echo ::warning::; fleet-submit + PR-comment both continue-on-error: true. Only the SARIF upload can fail (gates integration, not vulns). The mix escript.build step IS real — keep.

Fix these at their template origin in standards/rsr-template-repo first, then fan out here (don't hand-patch the copy and let it drift back).

Coverage gaps

• codeql.yml scans javascript-typescript only → the Rust core is unscanned. Advisory-on-findings is standard CodeQL behaviour (not a fake), but the language matrix misses the primary language of this repo. Add a rust analysis (CodeQL supports Rust) or wire an equivalent Rust SAST.
• README references scorecard.yml that does not exist. Either add the OpenSSF Scorecard workflow or remove the dangling reference.

contractile.just drift (local dev-only, not a PR gate — misleads devs)

contractile.just is auto-generated and has drifted from contractiles/must/Mustfile.a2ml:

• generated file has a broken must-spdx-headers (head -20 over a node_modules walk);
• source has no spdx rule at all, and a no-hardcoded-paths (severity:critical) rule that never made it into the generated file.
  Fix order: add a correct spdx rule to the source Mustfile first, build the contractile tool (currently not on PATH / not built), then regenerate. Regenerating without fixing the source first would DELETE the spdx coverage. Possible STOP-and-chat (estate seed + generator not built).

Acceptance

• dogfood-gate / hypatia-scan fakes fixed at template origin, then adopted here; each proven with a fail fixture.
• CodeQL (or equivalent) covers the Rust core.
• scorecard.yml added or the README reference removed.
• contractile source→build→regen path resolved (or explicitly deferred with a decision recorded).

Related upstream: standards PR #500 + the .gitleaks.toml and governance-reusable follow-up issues.