fix(ci): the invisible-character gate never matched anything

[hyperpolymath]

Supersedes #734 (unmergeable: DIRTY, and its inline Python scanner violates the estate language policy).

What

Replaces the broken character-mode PCRE escapes in dogfood-gate.yml's empty-lint job (\xc2\xa0 in grep -P asks for the two characters U+00C2 U+00A0 — present in no file, so the gate matched nothing for months) with the canonical byte-safe scanner that rsr-template-repo#49 hardened through four owner review rounds:

• scripts/check-invisible-characters.sh — ported verbatim from rsr-template-repo main. Matches UTF-8 byte sequences under LC_ALL=C (robust to invalid-UTF-8 files), NUL-delimited enumeration, fail-closed on find/grep errors.
• tests/invisible-characters-test.sh — the regression controls: NBSP, soft hyphen, zero-width/bidi, word-joiner, leading BOM, NUL, backspace, invalid UTF-8, permitted TAB/LF/CR, newline-bearing filenames, injected grep/find failures.
• Workflow wiring: two-tier semantics — typographic invisibles ::warning, C0/NUL corruption ::error + exit 1, scanner failure exit 2 (no partial pass). The job runs the regression proof before every scan.
• The seven NBSP-bearing docs the old gate never saw, fixed (carried over from fix(ci): the invisible-character gate never matched anything #734).

What this does NOT carry from #734

• The inline python3 heredoc scanner (Python is deny-listed estate-wide).
• The governance.yml reusable-workflow SHA bump — already stale again (standards HEAD has moved past it); re-pins are their own sweep.
• The .hypatia-exemptions.adoc wording fix — an equivalent fix already landed on main.

Verification (local, on this branch)

• tests/invisible-characters-test.sh → pass (10/10 fixtures detected, incl. leading BOM; blocking set exactly {NUL, backspace}; all three injected-failure controls fail closed).
• Full-tree scan of this branch → 0 findings, both tiers.
• Scanner vs the pre-fix doc versions from main → all flagged in the warn tier (the port detects the real defects the old gate missed).

Toolset integration map: hyperpolymath/empty-linter docs/INTEGRATION.adoc (landing separately).

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

Next included review available in 2 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 42fe8ed8-28e1-44c9-b8da-db5b250241e6

📥 Commits

Reviewing files that changed from the base of the PR and between 5ec5e9f and fef33fb.

📒 Files selected for processing (10)

• .audittraining/path-reference-drift/TYPOLOGY.adoc
• .audittraining/release-candidates/REPORT.adoc
• .github/workflows/dogfood-gate.yml
• docs/proof-debt.adoc
• docs/proofs/HANDOVER-neural-convergence.adoc
• docs/status/handover-2026-06-20.adoc
• docs/tech-debt-2026-05-26.adoc
• scripts/check-invisible-characters.sh
• src/ui/gossamer/BURBLE-DEFERRAL.adoc
• tests/invisible-characters-test.sh

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}