chore(gitignore): adopt standards#67/#68 entries; untrack ui/package-lock.json

[hyperpolymath]

Summary

• Appends the canonical .gitignore blocks from rsr-template-repo / v3-templater.
• git rm --cached ui/package-lock.json (file remains on disk locally; just no longer tracked) — closes the standards#67 estate-wide audit's only tracked-lockfile finding in this repo.
• Existing tracked .editorconfig is left in place per standards#68's owner ruling that "removing existing tracked copies is a separate per-repo owner-gated chore."

Why a draft

Per the standards#66 epic protocol: Refs, not Closes; joint-close only on explicit owner agreement.

References

• Refs Estate drift remediation — 2026-05-16 sweep findings standards#66
• Refs Eliminate npm lockfiles estate-wide (npm-avoidant) standards#67
• Refs Gitignore .editorconfig + .claude scaffolding estate-wide standards#68

Test plan

• .gitignore diff: 11 additive lines, two labelled blocks
• git ls-files 'package-lock.json' '**/package-lock.json' empty on branch
• Owner review

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 21 issues detected

Severity	Count
🔴 Critical	1
🟠 High	12
🟡 Medium	8

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in codeql.yml",
    "type": "missing_workflow",
    "file": "codeql.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in scorecard.yml",
    "type": "missing_workflow",
    "file": "scorecard.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in mirror.yml",
    "type": "missing_workflow",
    "file": "mirror.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in secret-scanner.yml",
    "type": "missing_workflow",
    "file": "secret-scanner.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Required file missing (condition: has_dependencies)",
    "type": "missing_requirement",
    "file": ".github/dependabot.yml",
    "action": "create",
    "rule_module": "cicd_rules",
    "severity": "high"
  },
  {
    "reason": "Required file missing (condition: public_repo)",
    "type": "missing_requirement",
    "file": ".github/workflows/scorecard.yml",
    "action": "create",
    "rule_module": "cicd_rules",
    "severity": "high"
  },
  {
    "reason": "Wildcard CORS -- restrict to specific origins or use env var (1 occurrences, CWE-942)",
    "type": "js_wildcard_cors",
    "file": "/home/runner/work/git-scripts/git-scripts/ui/server.mjs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence