fix(hull): scanner-registry cleanup — closes #30

[submtd]

Closes #30 — four deferred items from the #27 review, each an independent fix to hull or its tooling. No rendered workflow changes (all three hull goldens byte-identical); whole-branch review returned zero findings.

The four items

1. trufflehog's un-bumpable pin is now documented (item 1). Dependabot only bumps action refs that appear in this repo's committed workflows, and shipyard's own security.yml uses gitleaks by design — so trufflehog is shipped to consumers but never dogfooded here and never auto-bumped. The README now carries a trufflehog row in the action-pin table and names the manual path (edit scanners.py, run sync_action_pins.py). Documented rather than automated — a scheduled checker is more machinery than one pin warrants.

2. sync_action_pins.py regenerates all three hull goldens (item 2), not just security.yml. All three embed the actions/checkout SHA, so the next checkout bump would have left two stale with no script support. Now a filename→config map renders each, and assert not (_on_disk - set(map)) fails loudly if a new golden appears with no mapping — the exact bug, guarded.

3. Two per-scanner facts moved into ScannerSpec (item 3). A new advisory field carries trufflehog's BASE==HEAD caveat (moved verbatim), and the org-blocker's license-free remedy is derived from the registry (scanners whose license_env is None) instead of the literal "trufflehog". Register a third scanner and it gets an advisory channel and is offered as a remedy automatically. "trufflehog" no longer appears anywhere in scaffold.py.

4. The scan step copies scan_with before rendering (item 4), matching how it already copies env — closing a latent asymmetry where mutating a built plan could corrupt the shared registry entry process-wide.

Verification

• Suite 1436 → 1441 (5 new tests; TDD throughout).
• Three hull goldens byte-for-byte identical across the whole branch.
• Engine purity, the Every plugin needs a round-trip property test: propose_config output must load through load_config #33 round-trip contract, and least-privilege permissions all unchanged.
• Opus whole-branch review: Ready to merge, zero findings — independently confirmed the derived remedy can never offer the already-selected scanner and that all three sync-map configs reproduce the committed goldens.

This is the last open issue.

🤖 Generated with Claude Code

[submtd]

Self-review (author) — satisfies keel's reviewPolicy: review gate.

Four independent hull cleanup items closing #30. The opus whole-branch review returned zero findings and independently proved the two subtle risks: the derived license-free remedy can never offer the already-selected scanner (the org blocker only fires for a license-gated scanner), and the sync-script guard _on_disk - set(map) is the direction that catches an unmapped golden; all three sync-map configs reproduce the committed goldens byte-for-byte.

No rendered change: the three hull goldens are byte-for-byte identical across the whole branch. Tests 1436 to 1441 (5 new, TDD; the mutation guard and the source-scan are real drivers). Engine purity, the #33 round-trip contract, and least-privilege permissions unchanged; 'trufflehog' no longer appears in scaffold.py. Changelog Fixed entry accurate.

Ready to land.