fix(ci): repair doc-truthing guard after #614's .md→.adoc migration

[hyperpolymath]

What

Repairs main's red CI after #614 merged. The build job's ./tools/check-doc-truthing.sh governance guard failed because #614 migrated six status/history docs from .md → .adoc, but the guard still keyed off the old .md paths in two places:

• Presence list (BANNERED_DOCS) → bannered doc is missing for BACKEND-IMPLEMENTATION, COMPILER-CAPABILITIES, ALPHA-1-RELEASE-NOTES.
• Over-claim ratchet baseline (tools/doc-overclaims.allow) → new over-claim(s) for the migrated .adoc history/roadmap snapshots (identical, already-blessed claims — just at .adoc paths with .adoc markup).

On the previous main tip (2aa00ff) this guard was green, so this is a regression introduced purely by the migration — not new over-claiming.

Fix (hotfix + hardening)

1. Re-key the over-claim baseline to the migrated .adoc paths via the tool's documented --update. This is a 1:1 re-bless of identical historical/roadmap content — every removed .md signature has an equivalent .adoc one added; zero new live over-claims.
2. Harden the presence check so it can't re-break on a future migration: BANNERED_DOCS are now extension-less stems resolved to whichever of .adoc/.md is present (.adoc preferred).

Verification

• ./tools/check-doc-truthing.sh → exit 0: "OK: doc-truthing intact — presence invariants + over-claim ratchet (DOC-04/05/08/09)."
• Resolver unit-tested: both-present → .adoc; only .md → .md; neither → missing.
• dune build clean. (The only build-job step after the guard is dune build @fmt; this change touches no OCaml, so it's unaffected.)

Greens the build job / CI on main.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Lz7pRcec2Z3tVtaAhvB3M8

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 42 issues detected

Severity	Count
🔴 Critical	2
🟠 High	24
🟡 Medium	16

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action denoland/setup-deno@v2 needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "scorecard_publish_with_run_step",
    "file": "scorecard-enforcer.yml",
    "action": "split_scorecard_publish_job",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Shell execution -- validate input before passing to shell (1 occurrences, CWE-78)",
    "type": "js_exec_sync",
    "file": "/home/runner/work/affinescript/affinescript/packages/affinescript-cli/mod.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Shell execution -- validate input before passing to shell (2 occurrences, CWE-78)",
    "type": "js_exec_sync",
    "file": "/home/runner/work/affinescript/affinescript/packages/affine-vscode/mod.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Shell execution -- validate input before passing to shell (1 occurrences, CWE-78)",
    "type": "js_exec_sync",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-vite/src/affine-plugin-improved.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "expect() in hot path (32 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/affinescript/affinescript/affinescriptiser/src/codegen/wasm_gen.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "expect() in hot path (29 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/affinescript/affinescript/affinescriptiser/src/codegen/affine_gen.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unsafe block -- requires SAFETY comment (2 occurrences, CWE-676)",
    "type": "unsafe_block",
    "file": "/home/runner/work/affinescript/affinescript/runtime/src/panic.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unsafe block -- requires SAFETY comment (1 occurrences, CWE-676)",
    "type": "unsafe_block",
    "file": "/home/runner/work/affinescript/affinescript/runtime/src/alloc.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence