fix(ci): repoint codeql-action at a SHA that exists - #142

…s live on main) (#143)

## Urgent: a licence misstatement is currently live on the public
default branch

`guix.scm` on `main` declares this repository as **`squisher-corpus`**
under **`PMPL-1.0-or-later`**. It is neither — this is `maa-framework`,
MPL-2.0.

```diff
-  (name "squisher-corpus")                          +  (name "maa-framework")
-  (synopsis "squisher-corpus")                      +  (synopsis "maa-framework")
-  (home-page ".../hyperpolymath/squisher-corpus")   +  (home-page ".../hyperpolymath/maa-framework")
-  "PMPL-1.0-or-later"                               +  "MPL-2.0"
```

Restored verbatim from `7b6a293`, the last commit where it was correct.
**One file, six lines.**

## How it got here

An automated sweep on **2026-07-26 ~16:00 BST** copied
`hyper-repos/squisher-corpus/guix.scm` **byte-for-byte** into a large
number of estate repos rather than generating one per repo. The sweep's
own commit message names the bug: `chore: update guix.scm from
squisher-corpus`.

In this repo it first appeared as local commit `f06ea94`, which was
dropped on 2026-07-27 — `origin/main` was still clean at `7b6a293` at
that point.

**It reached `origin/main` anyway, via #142** (`fix(ci): repoint
codeql-action at a SHA that exists`), a CI fix that swept up an
unrelated dirty working-tree file. This is the `commit -a` on a dirty
tree hazard.

## Why this matters beyond cosmetics

1. **Identity** — the package advertises the wrong name and home-page.
2. **Licence** — MPL-2.0 was replaced with `PMPL-1.0-or-later` on a
public default branch.

`absolute-zero/.claude/CLAUDE.md` lists `PMPL-1.0` / `PMPL-1.0-or-later`
as **BANNED** ("License: MPL-2.0 only"), so this is a policy violation
as well as a factual error.

## Scope check

`.editorconfig` and `aletheia/.editorconfig` on `main` are **clean** —
`guix.scm` is the only affected file in this repository.

## Wider context (not fixed here)

A scan of **279 repos against their ORIGIN refs** finds **65 clobbered
`guix.scm` files across 52 repositories**, including `standards`. An
earlier scan against local working trees reported only 9 — it
undercounted roughly 6× because repos whose local checkout lags origin
were invisible to it. Tracked separately; this PR fixes only this
repository.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

…ut (#145)

## The last red check on `main`

`.claude/worktrees/maa-ci-repair` is committed on `main` as a
**gitlink** (mode `160000`, pointing at `0392152`) with **no matching
entry in `.gitmodules`**. Git treats that as an unmapped submodule and
refuses:

```
##[error]fatal: No url found for submodule path '.claude/worktrees/maa-ci-repair' in .gitmodules
##[error]The process '/usr/bin/git' failed with exit code 128
```

That is the **OSSF Scorecard** failure on `main`. It dies during
checkout, **before running a single scorecard probe** — so the red tick
says nothing about this repo's actual security posture.

It also breaks any `git clone --recurse-submodules` and any
`actions/checkout` with `submodules: true`.

## Where it came from

A Claude Code worktree is local scratch and must never be tracked. It
was committed by accident in **#142** (`fix(ci): repoint codeql-action
at a SHA that exists`) — the same `commit -a`-on-a-dirty-tree that
carried the `squisher-corpus` `guix.scm` clobber onto `main` (fixed
separately in #143). One careless `-a`, two unrelated defects.

## Why this shape matters

**This repo has been bitten by exactly this before.** Commit `639f389`
(2026-02-21) left `aletheia` as a gitlink with no `.gitmodules` entry. A
gitlink *without* its mapping resolves to a silently-empty directory —
git's quietest failure mode — and that one went unnoticed for over a
month until the pointer was swept away and 361 files were vendored in
its place.

## Fix

- `git rm --cached .claude/worktrees/maa-ci-repair` — index only,
contents untouched on disk
- add `.claude/worktrees/` to `.gitignore` so it cannot recur

## Verification

```
$ git submodule status
 87902bb770e767c10e065d9ac75d111e80a01be1 absolute-zero (heads/main)     # exit 0

$ git check-ignore -v .claude/worktrees/maa-ci-repair
.gitignore:136:.claude/worktrees/	.claude/worktrees/maa-ci-repair
```

Only `absolute-zero` remains, which is the one genuine submodule and is
correctly mapped.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>