Hypatia: drive the scan to green with a precise .hypatia-ignore (needs findings dump)

[hyperpolymath]

The scan / Hypatia check is non-blocking and currently red on confirmed false positives on RSR-template scaffolding (prohibition comments matched as violations, safe ${{ }} expressions, internal-service http URLs, commented-out examples). PR #3 added a documented .hypatia-ignore that took it 20 → 14 (critical eliminated); PRs after that did not reduce it further.

Blocker

The residual 14 (3 high, 11 medium) can't be enumerated from this sandbox:

• the gating scanner is an Elixir escript, and hex.pm is firewalled (403) so it can't be built/run here;
• the failing run never uploads its hypatia-findings.json artifact (the step fails before the upload step).

Path to green

1. Run ~/hypatia/hypatia-cli.sh scan . in a hex-enabled Elixir environment and capture hypatia-findings.json.
2. For each residual finding, add a precise module/type:path exemption to .hypatia-ignore (format documented in the file), or fix it if it's real.

Alternative (better)

Fix upstream in hyperpolymath/hypatia: don't flag prohibition comments (-- ...no believe_me...) as the banned token, and reconcile the code_safety SCM-location rule with honest_completion accepting the .machine_readable/6a2/ layout.

Ref: .hypatia-ignore, docs/guide/for-maintainers.adoc (Hypatia is advisory).