fix(ci): repair the fallow workflow

.fallowrc.json

@@ -5,7 +5,8 @@
     "**/coverage/**",
     "**/storybook-static/**",
     "**/*.generated.ts",
-    "patches/**"
+    "patches/**",
+    "examples/**"
   ],
   "ignoreDependencies": ["expo-splash-screen", "expo-sqlite"],
   "dynamicallyLoaded": [

.github/workflows/fallow.yml

@@ -24,6 +24,12 @@ jobs:
   report:
     name: Report
     runs-on: ubuntu-latest
+    # fallow's base-snapshot pass runs `git worktree add`, which triggers the
+    # repo's husky post-checkout hook inside the fresh worktree, where it dies
+    # with exit 127 and fails the worktree creation. HUSKY=0 both skips hook
+    # installation during pnpm install and short-circuits any installed shim.
+    env:
+      HUSKY: '0'
     steps:
       - uses: actions/checkout@v4
         with:
@@ -58,14 +64,31 @@ jobs:
           pnpm exec fallow audit \
             --changed-since "${{ steps.base.outputs.ref }}" \
             --format sarif \
-            --fail-on-issues \
-            --quiet > fallow-audit.sarif
+            --fail-on-issues > fallow-audit.sarif
+
+      # CodeQL's upload action rejects SARIF files that contain multiple runs
+      # under one category, and fallow emits one run per sub-analysis — this
+      # is why every upload failed before. Merge the runs (same driver) into
+      # one, and drop run-level notices without locations (code scanning
+      # requires every result to carry at least one; they still appear in the
+      # step summary). Producing the .single.sarif file only when the input
+      # parses also guards against the empty file a crashed audit leaves
+      # behind, which passes hashFiles() but is not valid JSON.
+      - name: Normalize Fallow SARIF to a single run
+        if: always()
+        shell: bash
+        run: |
+          if jq -e '.runs | length >= 1' fallow-audit.sarif > /dev/null 2>&1; then
+            jq '.runs[0].results = ([.runs[].results // []] | add | map(select((.locations // []) | length > 0))) |
+                .runs[0].tool.driver.rules = ([.runs[].tool.driver.rules // []] | add | unique_by(.id)) |
+                .runs = [.runs[0]]' fallow-audit.sarif > fallow-audit.single.sarif
+          fi
 
       - name: Upload Fallow SARIF
-        if: always() && hashFiles('fallow-audit.sarif') != '' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
-        uses: github/codeql-action/upload-sarif@v3
+        if: always() && hashFiles('fallow-audit.single.sarif') != '' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
+        uses: github/codeql-action/upload-sarif@v4
         with:
-          sarif_file: fallow-audit.sarif
+          sarif_file: fallow-audit.single.sarif
           category: fallow-audit
 
       - name: Run Fallow dead-code regression