Estate `scan` lane builds again (post #553) — triage per-repo medium+ findings

[hyperpolymath]

With the central blockers resolved — actions/cache SHA repair (standards#394), the scanner compile regression (#553), and the estate-wide reusable re-pin to current standards HEAD — the scan / Hypatia Neurosymbolic Analysis lane now builds and runs estate-wide instead of dying at mix escript.build.

Expected consequence: repos with genuine medium+ findings now show scan red on findings (the scanner working as intended) — distinct from the prior build failure, and not a regression. This is per-repo triage/fix work.

• Hypatia's own self-scan currently reports 25 medium (continuation of the fix(scanner): eliminate SD022 self-scan false positives (triage 43→~0) #543 / fix(scanner): make SD022 path-drift rule precise + fix real doc/workflow drift #545 triage).
• Other consumers surface their own findings as their scans re-run post re-pin.

Tracking umbrella for the per-repo findings triage across the estate.

Refs: #464, #553.

[hyperpolymath]

Status (2026-09-30 issue sweep): reviewed and kept open as a live meta-tracker. Feature/RFC issues were consolidated into the roadmap #886. Root-cause fixes in flight: #883 (scanner build + npx precision), #888 (workflow_audit path anchoring, 0-AI-MANIFEST.deed), standards#1084 (harden-runner in standards-only workflows). Ledger: dev-notes/audits/hypatia-issue-sweep/2026-09-30.md.