master is red: ruff, a to_dict() lost in a replay, vendored drift, Scorecard, yamllint on Windows

[Kartikey1306]

Symptom

CI — ebuild has been red on master since 09-08, and because the first failing step is ruff, mypy and pytest have not run on master since. Vendored core drift and OSSF Scorecard are red on the same commit for unrelated reasons.

Verified on 8b623d5

• ruff: F811 duplicate import shutil, W292 missing trailing newline, E402 ×2 (imports two hundred lines into tests/unit/test_ci_gate.py).
• mypy (once ruff passes): ebuild/packages/index_sync.py:354 calls PackageRecipe.to_dict(), which feat: implement package management system with recipe support, regist… #111 defined and fix(packages): validate recipe list fields #112 — merged five minutes later from a base without it — deleted in its replay. Nine test_index_sync cases fail with AttributeError. On 3.10/3.11 ebuild/plugins/__init__.py:46 also fails type-checking.
• Vendored drift 44 → 45: fix: derive SDK toolchain from detected profile #109 edited core/eos/docs/three-way-alignment.md, a snapshot pinned to eos 5544c98.
• Scorecard: ossf/scorecard-action@v2.4.0 pulls gcr.io, which now refuses with "requires billing to be enabled".
• yamllint has never passed on the Windows legs (added 09-03; the runner's core.autocrlf=true turns LF into CRLF).

Fix

#132.

[Kartikey1306]

Status as of 2026-09-17, so this issue reflects the current state rather than the one it was opened on.

• Repair: fix: repair master — the dropped to_dict() fields, vendored drift, scorecard pins (lint landed via #122) #132, head 4054494 — MERGEABLE, 30 checks passing, 0 failing, blocked only on a review. The head has not moved since the last re-approval request on the PR.
• Master: still red since 2026-09-15 (c37e995, and 76970c9 before it): CI — ebuild, OSSF Scorecard, Vendored core drift (09-15 18:22Z) and EoSim Sanity (09-16, 09-17). Every run of those workflows on master since then has failed; nothing else has touched the cause.
• Blocked behind it: ci: grade only open pull requests against the linked-issue policy #144, fix(packages): read ebuild.lock back, so it pins what it records #146, ci(book): Eisvogel 3.4.0, and stop defining \chead twice #148, ci: make the EoSim Sanity Gate fail on any dependency, and give it nothing to close on #151 — each stacked on fix: repair master — the dropped to_dict() fields, vendored drift, scorecard pins (lint landed via #122) #132's head and each green on its own diff.

Merging #132 first clears master and lets the rest rebase to their own single commits. Nothing further is needed from the author side; the PR body and comments carry the verification.