fix(ci): make the LSP/DAP/BSP gate real + policy-compliant

[hyperpolymath]

Makes the LSP/DAP/BSP CI gate actually verify instead of grep-and-hope, and brings it into policy. These are the two pre-existing red checks that surfaced on #196, plus flagged #199 items — all in one file.

Fixes

• abi-check — the "ABI Specification Check (Idris2)" job never ran Idris2; it greped believe_me|assert_total|sorry recursively and matched each abi/README.adoc's own "Zero believe_me…" prose → false-positive on every run. Now scoped to --include='*.idr' (a fast leaf-axiom guard). The real idris2 --check of every ABI is proofs.yml's job.
• ffi-build — replaced the dead curl ziglang.org/builds/…0.15.2 (nightly dir, not releases → tar died) with goto-bus-stop/setup-zig @ .tool-versions' 0.15.1, matching e2e.yml.
• panel-validation — python3 json.tool/json.load → jq (the repo's no-Python policy).
• Added timeout-minutes to all 4 jobs + a concurrency group.

Verified locally

• New grep no longer matches lsp-mcp/abi/README.adoc; finds zero axioms in the .idr (correct — leaf proofs are axiom-free, just confirmed across all 108 boj-server cartridge ABIs by a real idris2 --check sweep).
• jq forms validate the panel manifests (3 panels each).
• YAML parses clean.

Resolves the two lsp-dap-bsp.yml reds + several workflow-audit items in #199.

https://claude.ai/code/session_019tMcRS1Dm1nWjjYP4WvbJa

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 274 issues detected

Severity	Count
🔴 Critical	15
🟠 High	132
🟡 Medium	127

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Stale AI session file -- delete",
    "type": "stale",
    "file": "GEMINI.md",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "medium"
  },
  {
    "reason": "Action  if: always()\n        uses: actions/upload-artifact@ea165f8 needs attention",
    "type": "unpinned_action",
    "file": "e2e.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in abi-drift.yml",
    "type": "missing_timeout_minutes",
    "file": "abi-drift.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in container-publish.yml",
    "type": "missing_timeout_minutes",
    "file": "container-publish.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence