docs: onboarding polish — tutorial lesson-01 + audience router + STATE.a2ml refresh #1259

	# SPDX-License-Identifier: MPL-2.0
	# Thin wrapper around hyperpolymath/standards hypatia-scan-reusable.yml.
	# See standards#191 for the reusable's purpose and design.

	name: Hypatia Security Scan
	on:
	push:
	branches: [main, master, develop]
	# No `branches:` filter: this job emits the required check
	# `hypatia / Hypatia Neurosymbolic Analysis` (and drives the `Hypatia`
	# app check), so it must run on PRs against EVERY base. A required check
	# whose workflow is branch-filtered is never created and sits forever at
	# "Expected — Waiting for status to be reported".
	pull_request:
	schedule:
	- cron: '0 0 * * 0'
	workflow_dispatch:
	# Estate guardrail: cancel superseded runs so re-pushes don't pile up.
	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true
	permissions:
	contents: read
	security-events: write
	pull-requests: write
	jobs:
	hypatia:
	uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@5eb28d7d8790d5389b7b6a5233fe6265a775e3d0
	secrets: inherit

Provide feedback