feat(hypatia): define implementation-inside-canon rule

[hyperpolymath]

Summary

• define HYP-S009 from standards#498 using REGISTRY.a2ml local homes as the authoritative canon boundary
• route findings to review only; never auto-move implementation or licence-bearing content
• replace the broad two-level shell prototype with a tracked-file reference detector matching the rule contract
• exempt templates/examples/fixtures so template-as-spec content is not misclassified

Verification

• all 9 standards rules load through Hypatia.Rules.RuleLoader
• HYP-S009 parses as medium, non-autofixable, review-only, with 9 scanner globs
• positive control: detects a2ml/CNAME
• negative control: no example/template/fixture paths reported
• bash syntax and git diff checks pass
• just lint: Rust phase completes with existing warnings; Deno phase reports the existing 96 generated-JS findings under mcp-repo-guardian (no changed files involved)

Refs #498
Refs #479

[gitar-bot]

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

_Gitar

[sonarqubecloud]

Quality Gate passed

Issues
9 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud