security: remove tracked Packrat build artifacts

[seonghobae]

Pull Request

Summary

• Remove the generated packrat/lib installation tree (1,851 tracked files, about 58 MB), including 11 Linux .so/.deb build artifacts reported by Scorecard SARIF.
• Keep packrat.lock, packrat/init.R, and packrat/src so the legacy opt-in environment remains reproducible; ignore restored packrat/lib, packrat/lib-R, and packrat/lib-ext trees.
• Replace unpinned pip install yamllint and npm install -g markdownlint-cli2 workflow commands with full-SHA-pinned actions, addressing Scorecard PinnedDependenciesID alerts chore(deps): bump step-security/harden-runner from 2.14.2 to 2.15.0 #14 and chore(deps): bump step-security/harden-runner from 2.14.2 to 2.15.1 #15.
• Update repository guidance to distinguish tracked dependency sources from generated installed libraries.

Validation

• R_PROFILE_USER=/dev/null Rscript -e 'testthat::test_local(reporter="summary")'
• Clean staged-tree R CMD build succeeded
• Clean staged-tree R CMD check --no-manual --as-cran: 0 errors, 0 warnings, 3 pre-existing NOTEs
• yamllint, markdownlint-cli2, and actionlint succeeded
• Fresh Trivy DB scan (vuln,secret,misconfig, Medium+) found no issues; OSV reported no supported package source for this legacy R lock format
• Tracked compiled artifact inventory is empty
• Unpinned pip/npm install workflow command inventory is empty
• No secrets or credentials were added

Risk and Rollback

• Risk level: medium (large generated-tree deletion; package source and mathematical behavior are unchanged)
• Rollback plan: revert commit ee92fdd; the ignored installed tree can also be regenerated through the existing opt-in Packrat bootstrap.

Behavioral Impact

• R/aFIPC.R unchanged
• If changed, regression evidence is attached

Checklist

• Docs updated (README.md, ARCHITECTURE.md, CONTRIBUTING.md) as needed
• New/updated GitHub Actions use full commit SHA pinning
• Security policy / contribution policy alignment verified

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

[opencode-agent]

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for 804ea97cd83144f94c5020a9d42f2573cc8cb442.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/aFIPC/actions/runs/29796717850/job/88529427601)
• Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/aFIPC/actions/runs/29796717850/job/88529427601)

Changed-File Evidence Map

flowchart LR
  Evidence["OpenCode evidence"] --> Review["Current PR review path"]
  Review --> Verify["Required checks"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 804ea97cd83144f94c5020a9d42f2573cc8cb442
• Workflow run: 29826062413
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for 804ea97cd83144f94c5020a9d42f2573cc8cb442.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/aFIPC/actions/runs/29796717850/job/88529427601)
• Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/aFIPC/actions/runs/29796717850/job/88529427601)

Changed-File Evidence Map

flowchart LR
  Evidence["OpenCode evidence"] --> Review["Current PR review path"]
  Review --> Verify["Required checks"]

Loading

[opencode-agent]

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for 804ea97cd83144f94c5020a9d42f2573cc8cb442.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/aFIPC/actions/runs/29796717850/job/88529427601)
• Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/aFIPC/actions/runs/29796717850/job/88529427601)

Changed-File Evidence Map

flowchart LR
  Evidence["OpenCode evidence"] --> Review["Current PR review path"]
  Review --> Verify["Required checks"]

Loading

[seonghobae]

@strix review

Fresh exact-head security revalidation request for 804ea97cd83144f94c5020a9d42f2573cc8cb442 against base 35e44988487de8f5b8b7e57d9d76e18911b99841. The predecessor Strix run stopped before analysis because the central changed-path gate rejected the tracked legal Packrat fixture path Ugly, but legal, path for a project (long)/bread/DESCRIPTION. The organization control-plane repair .github#800 has since merged to protected main, specifically admitting commas and ASCII parentheses while preserving traversal and shell-syntax rejection. Please inspect this unchanged head with the current trusted Strix implementation; do not reuse predecessor failure/success evidence, mutate the branch, or synthesize approval.