PR-02: Repo hygiene (scanner)

[emmanuelgjr]

Phase 0 mechanical hygiene for the DSGAI scanner. Depends on PR-01 (merged).

What's here

• README Non-goals section — states what the scanner deliberately won't do (secret-scanning reimpl, general SAST, rules without fixtures, weakening redaction). The maintainer's burnout shield.
• .github/CODEOWNERS — /dsgai_scanner_tool/ @emmanuelgjr.
• .github/workflows/scanner-lint.yml — path-filtered to dsgai_scanner_tool/**: shellcheck -S warning on integrations/*.sh, yamllint on scanner YAML, and a deterministic internal markdown-link check. All three verified locally; actionlint clean.
• scripts/check_md_links.py — dependency-free internal-link/anchor checker (chosen over a third-party external-URL action, which would be a flaky required gate needing an unverifiable SHA pin).
• .gitattributes — forces LF on *.sh/*.py/*.yml/*.yaml. Prevents Windows autocrlf checkouts from shipping CRLF that breaks shellcheck/bash on Linux CI (a real failure I hit while validating).
• DSGAI-samplereport.png — compressed 5.0 MB → 0.35 MB (14×), valid PNG, display-neutral at the README's 800px width.

Verification

• shellcheck -S warning, yamllint, check_md_links.py, and actionlint all pass locally.
• PNG is 359,976 bytes (≤400 KB target) and a valid PNG.

Notes / deviations

• shellcheck is clean at warning level — the known mapfile (line 18) / grep -zE (line 20) portability bugs are bash-3.2/BSD concerns shellcheck can't detect without shell context, so there was nothing to # shellcheck disable. They're documented here and fixed in PR-10. The .sh file is intentionally left untouched (PR-10's scope).
• PNG ≤400 KB required downscaling, not just palette quantization — the source is 1976×16384 px (a 2¹⁴ browser screenshot cap) with content throughout, so compression alone bottomed out ~750 KB. Downscaled to 560px native (display-neutral at 800px). PR-09 replaces this with a proper hero crop from the fixture app.
• dependabot already covers the github-actions ecosystem; pip is added in PR-05 alongside the CLI manifest.
• Annotated tag scanner-v0.2.0 created locally at the pre-improvement baseline; push held for your explicit approval per the plan (batched with the later release tags).

Follow-ups

• PR-10: fix mapfile/grep -zE portability in dsgai-secret-scan.sh.
• PR-09: regenerate the sample PNG from the fixture app.