ci: add launcher-standard prose↔a2ml lock-step gate

[hyperpolymath]

Summary

launcher/README.adoc §Sync requirement declares that the
machine-readable form (launcher/launcher-standard.a2ml) and the prose
form (docs/UX-standards/launcher-standard.adoc) MUST be edited in the
same PR, and calls drift between them a "standards-compliance bug" —
but nothing enforced the rule. The recently-fixed cross-doc
contradictions in #170
were exactly the drift this rule was meant to prevent.

This adds .github/workflows/launcher-standard-lockstep.yml — a hard
gate that runs on every PR touching either file. If only one is in the
diff, it fails with a message naming the missing partner and pointing
back at §Sync requirement.

How it works

```yaml
on:
pull_request:
paths:
- 'launcher/launcher-standard.a2ml'
- 'docs/UX-standards/launcher-standard.adoc'
```

GitHub's paths: filter ensures the workflow only triggers when one of
the two files is touched (cheap — no wasted runs for unrelated PRs).
Inside the job, a 30-line bash check diffs pull_request.base.sha
against pull_request.head.sha, computes which of the two files are
touched vs missing, and fails iff the touched set is non-empty but
incomplete.

Dry-run verification

Logic dry-run locally against six synthetic diffs:

Diff	Expected	Result
only a2ml touched	FAIL — drift	FAIL ✓
only adoc touched	FAIL — drift	FAIL ✓
both touched	PASS	PASS ✓
both touched + unrelated	PASS	PASS ✓
neither touched	skip (no trigger)	workflow doesn't run ✓
a2ml + unrelated (drift)	FAIL — drift	FAIL ✓

Pattern conformance

Modelled on the existing makefile-blocker.yml gate:

• Same SPDX header.
• Same actions/checkout@de0fac2… pin (verified live against
  github.com/actions/checkout — corresponds to v4 commit
  de0fac2e4500dabe0009e67214ff5f5447ce83dd "Fix tag handling" #2356).
• Same concurrency block that cancels superseded runs (safe — this is
  a read-only check, no mutations).
• Same permissions: contents: read.

Scope notes

• Initial group is the 2-file pair the README literally calls out.
  Once #171
  lands and introduces launcher/resolve-desktop-tools.sh, a follow-up
  should extend the group to include the resolver (which mirrors
  [resolution] in the a2ml and currently relies on reviewer
  discipline).
• Hard fail, not warning. The README uses "MUST" / "is a bug"
  language; the gate matches that strictness. Genuinely one-sided
  edits (e.g. a prose-only typo fix with no a2ml equivalent) need a
  no-op whitespace touch to the other file — the error message
  documents this escape.
• Not added to required-checks list. Branch-protection config
  lives outside the repo. Owner can promote this to a required check
  via the UI or .github/settings.yml once they've seen it pass green
  on a few PRs.

Coordination

• Fully independent of fix(launcher-standard): resolve 3 cross-doc contradictions #170 and fix(launcher-standard): replace hard-coded /var/mnt/eclipse/... with a search-ladder #171 — touches a different file
  (.github/workflows/launcher-standard-lockstep.yml). No conflicts
  in any merge order.

Test plan

• Dry-run against 6 synthetic diff scenarios — all expected outcomes
• actions/checkout SHA pin verified live
• YAML syntactically valid (workflow loads — visible in Actions tab
  once branch is pushed)
• First live trigger will happen when PR fix(launcher-standard): resolve 3 cross-doc contradictions #170 or fix(launcher-standard): replace hard-coded /var/mnt/eclipse/... with a search-ladder #171 next pushes
  and touches a group file — at that point this gate's run will
  appear on those PRs

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 118 issues detected

Severity	Count
🔴 Critical	64
🟠 High	43
🟡 Medium	11

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/deno-ci-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "deno-ci-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/a2ml-templates/state-scm-to-v2.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/a2ml/bindings/deno/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/lol/test/vitest.config.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/k9-svc/bindings/deno/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "Agda postulate assumes without proof -- potential soundness hole (4 occurrences, CWE-704)",
    "type": "agda_postulate",
    "file": "/home/runner/work/standards/standards/lol/proofs/theories/information_theory.agda",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/standards/standards/lol/src/abi/Locale.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "Wildcard CORS -- restrict to specific origins or use env var (1 occurrences, CWE-942)",
    "type": "js_wildcard_cors",
    "file": "/home/runner/work/standards/standards/consent-aware-http/examples/reference-implementations/deno/aibdp_middleware.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence