Clear recurring poutine untrusted_checkout_exec findings via .poutine.yml skip

[Copilot]

The static-analysis report flags 10 recurring untrusted_checkout_exec findings on smoke-workflow-call*.lock.yml, attributed across two reports to an off-by-one in where the compiler emits # poutine:ignore untrusted_checkout_exec.

That diagnosis is wrong. Poutine 1.1.6 has no inline comment suppression mechanism — its parser discards YAML comments, and skip: in .poutine.yml (or --skip) is the only supported acknowledgement path (see findings.rego). No comment repositioning would have cleared these.

Changes

• .poutine.yml — added a skip entry scoped to the rule plus the two affected lock files. The findings are false positives: the flagged steps run scripts staged under ${RUNNER_TEMP}/gh-aw/actions, emitted by the compiler into the lock file itself rather than read from the caller-controlled checkout, so they can't be influenced by the untrusted ref.

skip:
  - rule: untrusted_checkout_exec
    path:
      - .github/workflows/smoke-workflow-call.lock.yml
      - .github/workflows/smoke-workflow-call-with-inputs.lock.yml

• daily-vulnhunter-scan.md (+ recompiled lock) — fixed the new SC2015 note, preserving semantics:

-(cd "$REPO_ROOT" && grep -rlE "$2" . 2>/dev/null || true) \
+(cd "$REPO_ROOT" || exit 0; grep -rlE "$2" . 2>/dev/null || true) \

Running poutine locally before/after: 21 → 11 findings, all 10 untrusted_checkout_exec cleared, no other rule affected.

Deliberately out of scope

• The inert # poutine:ignore comments (1,134 lines across 282 lock files) are left in place — no-ops either way, and removing them churns a huge diff for zero change in scanner output. Worth a follow-up decision rather than bundling here.
• RGS-004 on dev-hawk.lock.yml — the report's own recommendation is an upstream runner-guard change or a suppression syntax that doesn't exist yet.
• Grype [Unknown]-severity CVEs and base-image refreshes — container-image concerns, not repo code.

• Fixes [static-analysis] Report - 2026-08-07 #51005