chore(security): clear Hypatia false-positives (.envrc example + setup.sh doc)

[hyperpolymath]

Why

Follow-up to #34, addressing the residual false-positive findings from the Hypatia scan on that PR. No runtime behaviour changes — these only remove patterns that trip naive scanners.

Changes

.envrc "Generic API key" (was flagged critical — false positive)

Line 24 was a commented # export API_KEY="..." placeholder (value literally "..."), which is why gitleaks/trufflehog all passed. Moved the commented API_KEY / DATABASE_URL examples into a new .envrc.example template; .envrc keeps a pointer comment. Real secrets still belong in a local, gitignored .env (loaded by dotenv_if_exists).

setup.sh doc references (CWE-494 hardening tidy-up)

• Dropped the curl … | sh convenience one-liner from the usage comment.
• Reworded the helper header (avoids curl|sh → no pipe-to-shell).

After this, no curl-pipe-to-shell substring remains anywhere in setup.sh — even in comments — so a line-regex scanner finds zero.

Verification

• sh -n setup.sh passes.
• grep confirms zero curl|wget … | sh/bash matches in setup.sh and zero API_KEY=/DATABASE_URL= assignments in .envrc.
• .envrc.example carries an SPDX MPL-2.0 header (REUSE-compliant).

Note on the other Hypatia findings

• scorecard_publish_with_run_step (CSA001/CSA003): fixed by fix(security): resolve three deferred Hypatia findings (CodeQL/scorecard/setup.sh) #34; stale alerts clear on the next main scan.
• DependencyPinning: false positive — the only @vN refs are commented-out examples in release.yml.
• GS007 (12 remote branches): being handled separately by deleting merged branches.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Y2MWTAqX2x7goVJzjFB4j5

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 3 issues detected

Severity	Count
🔴 Critical	1
🟠 High	0
🟡 Medium	2

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "line": 9,
    "reason": "Secret found: Generic API key",
    "type": "secret_detected",
    "file": "/home/runner/work/wokelangiser/wokelangiser/.envrc.example",
    "action": "revoke_rotate_and_purge",
    "rule_module": "security_errors",
    "severity": "critical"
  },
  {
    "reason": "1 workflow(s) with tag-pinned (not SHA-pinned) actions in wokelangiser",
    "type": "DependencyPinning",
    "file": "/home/runner/work/wokelangiser/wokelangiser",
    "action": "auto_fix",
    "rule_module": "scorecard",
    "severity": "medium",
    "remediation": "Pin GitHub Actions and Docker base images by SHA hash.",
    "scorecard_check": "Pinned-Dependencies"
  },
  {
    "reason": "Repository has 12 non-main remote branch(es). Policy: single main branch only.",
    "type": "GS007",
    "file": ".",
    "action": "delete_remote_branches",
    "rule_module": "git_state",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

[github-actions]

🔍 Hypatia Security Scan

Findings: 2 issues detected

Severity	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	2

View findings

[
  {
    "reason": "1 workflow(s) with tag-pinned (not SHA-pinned) actions in wokelangiser",
    "type": "DependencyPinning",
    "file": "/home/runner/work/wokelangiser/wokelangiser",
    "action": "auto_fix",
    "rule_module": "scorecard",
    "severity": "medium",
    "remediation": "Pin GitHub Actions and Docker base images by SHA hash.",
    "scorecard_check": "Pinned-Dependencies"
  },
  {
    "reason": "Repository has 12 non-main remote branch(es). Policy: single main branch only.",
    "type": "GS007",
    "file": ".",
    "action": "delete_remote_branches",
    "rule_module": "git_state",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence