fix(launcher-standard): resolve 3 cross-doc contradictions

[hyperpolymath]

Summary

The launcher standard (docs/UX-standards/launcher-standard.adoc +
launcher/launcher-standard.a2ml) and the lifecycle standard
(docs/UX-standards/LM-LA-LIFECYCLE-STANDARD.adoc) disagreed on three
points. Each was a real contradiction — not stylistic drift — and would
have left a downstream implementer unsure which doc to follow.

• --browser was listed as an independent required mode in the a2ml
  while prose calls it an alias for --auto. Split [required-modes]
  (canonical only) from a new [aliases] table mapping
  --browser/--web → --auto. Same enforcement, cleaner taxonomy.
• --integ / --disinteg supersede the standalone install/uninstall
  scripts (per launcher-standard.adoc v0.2.0), but LM-LA never absorbed
  the change. Added IMPORTANT callouts to §Installation Standard and
  §Uninstallation Standard scoping the script templates as reference for
  what --integ / --disinteg must do internally, and marking the
  standalone scripts optional when those modes exist.
• sudo violation: launcher-standard.adoc design principle 5 forbids
  elevated privileges, but the LM-LA templates ran sudo dnf, sudo cp,
  sudo systemctl. Added a "Privilege model" callout: sudo paths are
  opt-in platform-maintainer extensions for machine-wide deployment only;
  a launcher's --integ MUST NOT invoke them without explicit --system
  opt-in. Missing deps under a user install fail with an actionable
  message, not escalate.

Spec version bumped 0.2.0 → 0.3.0 (taxonomy change in [required-modes];
behaviour for compliant launchers is unchanged because every accepted
input is still accepted).

Out of scope (follow-ups identified but deferred)

Surfaced during the same review, not bundled here so this PR stays
small enough to read:

• No CI gate enforcing the prose↔a2ml lock-step requirement stated in
  launcher/README.adoc:37-39.
• Hard-coded /var/mnt/eclipse/repos/... paths in the a2ml fallback and
  .desktop examples — breaks on non-eclipse hosts.
• Browser launcher missing macOS open, WSL wslview, \$BROWSER.
• wait_for_server flat-1s polling ignores the
  wait-for-url-timeout-seconds constant the a2ml already declares.
• PID/log under predictable /tmp/ names — symlink-attack target on
  shared hosts; should use \$XDG_RUNTIME_DIR / \$XDG_STATE_HOME.
• keepopen.sh doesn't honour NO_COLOR.
• gui-dialog-chain and [soft-attach] declared in a2ml without
  reference impl → every downstream launcher will reinvent.
• --version mode missing entirely from required-modes.

Happy to take any of these in follow-up PRs.

Test plan

• AsciiDoc renders (visual diff — only added [IMPORTANT] blocks and one bullet)
• a2ml parses (additive [aliases] table + literal-string list shortening)
• Downstream launch-scaffolder rebuild picks up the new [aliases] table (separate repo)

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 192 issues detected

Severity	Count
🔴 Critical	64
🟠 High	100
🟡 Medium	28

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/deno-ci-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "deno-ci-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/a2ml-templates/state-scm-to-v2.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/a2ml/bindings/deno/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/lol/test/vitest.config.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/k9-svc/bindings/deno/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "Agda postulate assumes without proof -- potential soundness hole (4 occurrences, CWE-704)",
    "type": "agda_postulate",
    "file": "/home/runner/work/standards/standards/lol/proofs/theories/information_theory.agda",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/standards/standards/lol/src/abi/Locale.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "Wildcard CORS -- restrict to specific origins or use env var (1 occurrences, CWE-942)",
    "type": "js_wildcard_cors",
    "file": "/home/runner/work/standards/standards/consent-aware-http/examples/reference-implementations/deno/aibdp_middleware.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence