fix(security): preserve pinned authority across CodeQL history pages

[CaspianG]

Summary

Fix the real invalid_pagination failure in main Safe Product run 34542239525, observed after #121 merged the Brain preview and README.

GitHub's multi-page main analysis history uses numeric repository-ID Link paths. The adapter now treats those links only as page-transition hints and reconstructs every request on the original named repository endpoint. Origin, endpoint, immutable filters, duplicate keys, forward progress, caps, deadlines, redirect protection and later blocking alerts remain enforced. No scanner suppression, alert dismissal, first-page-only shortcut or permission change.

Reviewed feature: e5dafe3fcc25bdef087dca2d2f6240e5f146fd49; source fix fb269290278facadbb8773ab64a01145a2e59693, then official artifact-only refresh. Actual tested merge: 77c7422361623d5d0d4568f91a9fca98781f5e3b, with exactly main f8e0a16 and feature e5dafe3 as parents; its tree equals the reviewed local tree.

Validation

• Independent scoped review: spec and quality PASS; all findings addressed, no new Critical/Important breakage.
• Actual-header RED: 2 failures before production change. Final CodeQL selection 90 passed; covering selection 123 passed; artifact regressions 4 passed.
• Local full source-bound D1 command: python scripts/verify_brain_d1.py --expected-source-sha e5dafe3fcc25bdef087dca2d2f6240e5f146fd49 --output <fresh-evidence> — 1941 passed, 16 explicit optional skips, 694.50s. All427 Brain/native13/F01–F14 pass, clean exact source. Windows/Python3.13.2. D1 evidence SHA256 7800362639ee4bd41905ae05b790484ee2144362148921fa0022d3997f742731.
• Fresh build, Twine and isolated wheel import/entry-point/five identical asset HTTP checks PASS. Ruff, product-status sync and full diff checks PASS.18 inherited protective-exclusion/disabled-byte-compilation build notices retained, not hidden.
• Actual hosted full-check: 1940 passed, 17 explicit optional skips, all427 Brain/native13/F01–F14 pass; Linux/Python3.11.16, zero collection errors, one DeprecationWarning. Original artifact10179091768 SHA256 6f817759698a6f0537978b3f7058e776e9829c2d9ec14e9105bf43a34c7f207b; clean1587-file before/after manifest 010d5460e249f233ae03057422f59fd5f27b6238bda6835a7dc7976fe508fe30. No unexpected or Brain skips.
• 52 applicable PR checks PASS, only intentional PR site-deployment skip. Four exact-SHA CodeQL configurations completed error-free, no open alerts. Required strict full-check satisfied without bypass.
• Actual Safe Product / workspace / evaluation: all12 original JSON files downloaded and verified for integrity, exact source and appropriate current-file manifests. Safe Product19/19, workspace operational9/9, evaluation validity16/16. CodeQL report SHA256 ae26db9bd507dc5f51c54dd8d45254d53bac958042d4755d0a88182d136862ea; SafeProduct f4a515fd401157b3baad2c59811ad95c7db90e977038876376c94161948d49c4; evaluation 64c2121e068121a20e7340bc0daa0da1b905aa749282573eace315482efeeea6.
• Existing operator workflow path filters do not match this seven-file pagination/evidence diff; no new operator run is claimed. Previous main operator success and earlier unknown-cause latency failure retain their own source scopes. No manual rerun or threshold/load change.

Evidence And Release Impact

Only the adapter, regression tests and five established generated evidence files change. Generated differences are timestamps/source bindings and dependent digests; checked-in local admission remains15/16 blocked without hosted prerequisites. No Brain runtime, token issuance, README, workflow, dependency, version or benchmark outcome change.

PR success is not post-merge main success: verify the new main run separately, including the full paginated history that originally failed. The original failed main run remains preserved.

No release/tag/PyPI publication. D1 remains a Python-based plaintext preview for nonsecret material; D2 installation, D3 team deployment, D4 measured usefulness and scientific novelty are unfinished. Engineering and measurement-validity admission do not establish a scientific breakthrough or mass usefulness.

Checklist

• Focused diff; scoped review and full local/hosted tests inspected.
• Ruff, package checks and product-status synchronization pass.
• Exact source-bound original CI artifacts verified.
• Historical failures and evidence limits preserved.
• No credentials, private datasets, real user data or scanner exclusions included.
• All applicable current PR checks confirmed before merge.
• Post-merge main verification is a separate remaining step, not represented as complete here.

[CaspianG]

Post-merge verification complete for actual main f1b21eb: all 52 checks / 8 triggered workflows passed, with no failed, pending or skipped checks.

• Full check: original D1 artifact10179383913 shows1940passed,17explicitoptionalskips, all427Brain/native13/F01–F14pass, clean exactsource. SHA256 376a2b4e1d0ce5954750b502460912d21b9664e59418a69786d9c5bd053f3fc8.
• Safe Product / workspace / evaluation: all12originalJSONartifacts independentlychecked forintegrity/exactmainSHA/currentmanifests. SafeProduct19/19,workspaceoperational9/9,evaluation16/16.
• Actual main CodeQL history was traversed successfully: four current configurations, zeroopenhigh/critical/other;5existingdismissed and10historicalfixedrecords retained. Original main's invalid_pagination failure is resolved without scanner suppression, new dismissals or workflow reruns.
• Updated README is confirmed onmain. PR121/122 engineering publication and integration are complete.

This closes the pre-merge body’s remaining main-verification step. It does not complete D2 installation, D3 team deployment, D4 real-user/scientific validation or a new release. Old failure records remain preserved; no scientific-breakthrough or mass-readiness claim is made.