fix(launcher-standard): replace hard-coded /var/mnt/eclipse/... with a search-ladder

[hyperpolymath]

Summary

The launcher standard previously hard-coded /var/mnt/eclipse/repos/...
as the sole literal-fallback path for:

• launch-scaffolder finding launcher-standard.a2ml
• .desktop files finding keepopen.sh
• --integ finding verify-desktop-integrity.sh

On any host that doesn't use the eclipse-mount layout (e.g. this one —
/home/hyperpolymath/developer/repos/), the documented default fallback
pointed at a non-existent path. The standard's defaults did not work.

This blocked anyone outside that one layout from using the documented
templates: they had to set --standard <path> / \$LAUNCH_SCAFFOLDER_STANDARD
on every invocation, and could not rely on the documented .desktop
templates at all.

What changed

• [resolution] table added to launcher-standard.a2ml with two
  search ladders — desktop-tools-search (finds .desktop-tools/)
  and standard-search (finds the spec itself). Each ladder is ordered:
  explicit env-var override → estate-root → XDG default → three known
  absolute layouts (eclipse, \$HOME/developer/repos, \$HOME/dev/repos).
  First existing match wins.
• launcher/resolve-desktop-tools.sh added — bash reference
  implementation of both ladders, exposing hp_resolve_desktop_tools
  and hp_resolve_standard as sourceable functions, plus a small CLI
  (--list, --standard, <tool-name>). Downstream launchers SHOULD
  use this rather than re-implementing the ladder.
• Existing deployed-symlink and fallback-paths literals kept but
  marked DEPRECATED. Removing them would break launch-scaffolder
  until it's rebuilt against the new spec; the deprecation marker is
  the migration signal.
• Prose docs updated: launcher-standard.adoc §Canonical location
  describes the ladder + references resolve-desktop-tools.sh; the
  .desktop Exec= example carries a comment that the path is
  resolved at install time (because the freedesktop spec does NOT
  expand env vars in Exec= lines).
• launcher/README.adoc consumer-resolution-order section updated
  to describe the ladder instead of the obsolete single literal.

Verified on this host

```
$ launcher/resolve-desktop-tools.sh --standard
/home/hyperpolymath/developer/repos/standards/launcher/launcher-standard.a2ml
```

(previously: nothing — the only candidate path was the eclipse one)

a2ml parses clean (verified with python tomllib): 13 top-level tables,
resolution.desktop-tools-search has 6 entries,
resolution.standard-search has 5.

Coordination

• Independent of #170 — different files except both bump [spec].version. I deliberately did NOT bump version here; whichever PR merges second needs a trivial conflict-resolve to land both bumps (suggested: fix(launcher-standard): resolve 3 cross-doc contradictions #170 → 0.3.0, this → 0.4.0).
• Follow-up in launch-scaffolder (separate repo): replace the single hard-coded fallback in its Rust loader with the [resolution].standard-search ladder. Until that lands, this PR is documentation-and-helper only for that consumer — but it already unblocks any new launcher that sources resolve-desktop-tools.sh.

Out of scope (still deferred from the original review)

• CI gate enforcing prose↔a2ml sync (referenced inside the new resolver script's header so the gate has somewhere to point).
• Browser launcher missing macOS open, WSL wslview, \$BROWSER.
• wait_for_server ignores the wait-for-url-timeout-seconds constant.
• PID/log under predictable /tmp/ names (XDG hygiene).
• keepopen.sh doesn't honour NO_COLOR.
• --version mode missing from required-modes.
• [soft-attach] / gui-dialog-chain lack reference impls.

Test plan

• a2ml parses (python tomllib)
• resolve-desktop-tools.sh --standard finds the spec on this host
• resolve-desktop-tools.sh --list shows the full ladder
• resolve-desktop-tools.sh keepopen.sh correctly returns exit 1 when no .desktop-tools/ is deployed (expected — that's a separate integration step)
• Downstream launch-scaffolder rebuild picks up the new ladder (separate repo)

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 192 issues detected

Severity	Count
🔴 Critical	64
🟠 High	100
🟡 Medium	28

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/deno-ci-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "deno-ci-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/a2ml-templates/state-scm-to-v2.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/a2ml/bindings/deno/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/lol/test/vitest.config.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/k9-svc/bindings/deno/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "Agda postulate assumes without proof -- potential soundness hole (4 occurrences, CWE-704)",
    "type": "agda_postulate",
    "file": "/home/runner/work/standards/standards/lol/proofs/theories/information_theory.agda",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/standards/standards/lol/src/abi/Locale.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "Wildcard CORS -- restrict to specific origins or use env var (1 occurrences, CWE-942)",
    "type": "js_wildcard_cors",
    "file": "/home/runner/work/standards/standards/consent-aware-http/examples/reference-implementations/deno/aibdp_middleware.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence