Hypatia.ScorecardReconciler: close the GitHub code-scanning alert-lifecycle loop

[hyperpolymath]

Refs #260 (do not auto-close).

Gap: Hypatia ingests Scorecard into its own pipeline but never writes back to GitHub alert state. Non-actionable (#44 Maintained) and accepted-exception (#63 SLSA) findings re-accumulate as open every audit — the structural recurrence cause.

Build: Hypatia.ScorecardReconciler — pull live code-scanning alerts via GitHub API; per alert classify via the 4-axis taxonomy → {actionable→dispatch fix, accepted-exception→dismiss won't-fix+rationale, non-actionable/info→dismiss won't-fix+rationale}. Idempotent. Persist every decision keyed by stable (repo, rule, location_fingerprint) so re-scans never re-open. Mirror registry to .git-private-farm for offline-survivable learning.

[hyperpolymath]

Jointly closed by explicit maintainer agreement (2026-05-17). Landed via PR #264: Hypatia.ScorecardReconciler — Sense(live alerts)→Classify(4-axis taxonomy)→Act→Verify→Learn; line-drift-stable fingerprint; ~/.git-private-farm offline registry mirror. Proven live against modshells 2026-05-17: found=1, recurrence_defects=[], registry mirrored. Refs #260.