Systemic CI Failure: Rogue .claude/ orphan gitlinks breaking submodules

[hyperpolymath]

This is a class of problem breaking our CI pipelines (specifically \governance / Validate Hypatia Baseline, \scan / gitleaks, and \scan / rust-secrets).

Symptom:
These checks execute \git submodule foreach\ which strictly fails with \atal: No url found for submodule path .claude/worktrees/actions-policy in .gitmodules\ and exit code 128.

Root Cause:
Agentic tools (like Claude) use a local .claude/worktrees/\ directory. If a bot or developer blindly runs \git add ., these nested git repositories are added as orphan gitlinks (mode 160000) without a corresponding .gitmodules\ entry. This corrupts the git tree for any tool trying to traverse submodules.

Systematic Address Required:

1. Clean up existing .claude/ gitlinks from main.
2. Ensure .claude/\ is in the global estate .gitignore.
3. Add a Hypatia or \cicd squabbler\ rule to explicitly reject PRs that introduce \160000\ mode files inside .claude/\ or without a .gitmodules\ entry to prevent regressions.

The solution is partially underway (gitlink removal), but the systemic Hypatia rule needs to be implemented to permanently prevent this class of problem.