ci(diagnostic): hypatia-findings-dump — surface residual findings for triage

[hyperpolymath]

Why

Tooling to unblock the Q4 hypatia residual triage. I can't run the Elixir scanner in-session or download the CI hypatia-scan-findings artifact, and the gate's job log only prints a one-line count. This adds an informational, non-gating workflow that runs the scanner the same way the standards reusable does and dumps the findings to the job log — totals, by-severity, by-rule, by-top-level-path, and one line per finding — so I can read them via the job logs and produce the precise fix-vs-baseline plan.

Notes

• Not a gate. It only logs; it never fails the build on findings.
• Submodules are not checked out, so it scans reposystem's own tree only — the residual after the de-vendor (chore(submodules): de-vendor rpa-elysium to a real gitlink + drop total-recall dup #133) + extraction (chore(submodules): extract the 5 local-only standalones to gitlinks #134) work.
• Mirrors the standards hypatia-scan-reusable setup (same checkout / setup-beam SHAs, Elixir 1.19.4 / OTP 28.3, same hypatia-cli.sh scan . invocation).
• Triggers on workflow_dispatch and on PRs touching its own file, so it adds no noise to normal PRs.
• Safe to delete once the triage is done — I'll propose removing it (or keeping it as a manual diagnostic) alongside the remediation plan.

This PR exists mainly to run the dump; I'll read the findings from its job log and come back with the plan.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KhFfkfjKaB7Rg957u3uCT6

---

Generated by Claude Code