ci: centralized roadmap-#35 sweeper (one workflow, one secret)

[hyperpolymath]

ci: centralized roadmap-#35 sweeper (one workflow, one secret)

Replaces the need to install a per-repo add-to-project workflow + secret in
every repo. A single scheduled workflow here sweeps recently-touched issues &
PRs from every owned repo (except son-shared: idaptik/burble/rattlescript/
vcl-ut) into the Hyperpolymath Master Roadmap (#35).

• One secret (reuses the existing ADD_TO_PROJECT_PAT here); nothing to place in
  other repos. GITHUB_TOKEN can't read other repos, so cross-repo reads use the
  PAT. addProjectV2ItemById is idempotent, so overlapping windows are safe.
• No external actions (pure gh) => no SHA-pin / allowlist friction.
• Runs every 30 min + workflow_dispatch for on-demand.
• LIMITATION (deliberate, to finish in a focused follow-up): with the PAT's
  current project+public_repo scope this covers PUBLIC repos only; private repos
  need the PAT widened to repo (still one secret, one place). The run logs the
  scanned-repo count so the gap is visible.

Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com

[github-actions]

🔍 Hypatia Security Scan

Findings: 44 issues detected

Severity	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	44

View findings

[
  {
    "reason": "Issue in add-to-roadmap.yml",
    "type": "missing_timeout_minutes",
    "file": "add-to-roadmap.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Repository has 5 non-main remote branch(es). Policy: single main branch only.",
    "type": "GS007",
    "file": ".",
    "action": "delete_remote_branches",
    "rule_module": "git_state",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/workflow_audit/missing_timeout_minutes -- Hypatia workflow_audit: missing_timeout_minutes -- 0 day(s) old",
    "type": "CSA001",
    "file": "add-to-roadmap.yml",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 11 day(s) old",
    "type": "CSA001",
    "file": "src/ui/gossamer/README.adoc",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 11 day(s) old",
    "type": "CSA001",
    "file": "scripts/ci-tools/Cargo.toml",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 11 day(s) old",
    "type": "CSA001",
    "file": "scripts/bench-tools/Cargo.toml",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 11 day(s) old",
    "type": "CSA001",
    "file": "ffi/zig/README.adoc",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 11 day(s) old",
    "type": "CSA001",
    "file": "docs/reports/audit/audit-2026-04-15-post.md",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 11 day(s) old",
    "type": "CSA001",
    "file": "docs/integration/github-registry.adoc",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 11 day(s) old",
    "type": "CSA001",
    "file": "docs/integration/github-registry.adoc",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence