[uk-ai-resilience] Untracked commit-hygiene finding: stray binary/template artifacts committed to main (alert #680, Tier B)

### Summary

A CodeQL "Malicious Code Scanner" finding (alert [#680](https://github.com/github/gh-aw/security/code-scanning/680), created 2026-09-11) flags that a stray compiled Go binary and template-leak artifacts were committed directly to `main` in commit `bc736c8` ("Validate external safe-output secrets before activation", #60267):

- `test_dup_import` — a 2.3MB Go ELF binary (statically linked, unstripped, not referenced by any build script, workflow, or Go code)
- `tmp/smoke_test_22524436360.go` — a leftover smoke-test placeholder
- `{outname}.f` — an empty file with an unresolved template variable name

### Tier: B — Open With Conditions

| Dimension | Rating |
|---|---|
| Exposure amplification | Low |
| Patchability | High |
| Detectability | Low (scanner-only; not caught by normal review) |
| Operational fragility | Low |
| Ownership confidence | Medium |

### Rationale

Disassembly shows `test_dup_import`'s `main.main` is a trivial 2-line program with no `net/http`, `os/exec`, or `net.Dial` symbols linked — it has no exfiltration or execution capability, so the payload itself is benign. However, this is direct evidence that an automated/agentic commit path wrote build artifacts and broken template output directly to the working tree without review — a commit-hygiene/process-integrity gap in the automation behind commit `bc736c8`, which the UK AI Open Code Risk & Resilience guidance treats as a control gap independent of payload severity.

### Remediation action

1. Remove `test_dup_import`, `tmp/smoke_test_22524436360.go`, and `{outname}.f` from the repository.
2. Add `.gitignore` rules to block compiled test binaries and `tmp/` scratch files from being committed.
3. Audit the automation/agent process behind commit `bc736c8` to determine why these artifacts were produced and committed, and add a pre-commit/CI guard if feasible.

### SLA urgency: High — 14 days

### Reference

Full discussion report: see the "UK AI Open Code Risk & Resilience" weekly discussion report for 2026-09-08 to 2026-09-15 in this repository's Discussions.

> Generated by [UK AI Operational Resilience](https://github.com/github/gh-aw/actions/runs/34988746047) · copilot · auto · 87.8 AIC · ⌖ 6.25 AIC · ⊞ 8.2K · [◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw+is%3Aissue+%22gh-aw-workflow-call-id%3A+github%2Fgh-aw%2Fuk-ai-operational-resilience%22&type=issues)

Inspect commit bc736c8 and the three named artifacts: test_dup_import, tmp/smoke_test_22524436360.go, and {outname}.f. Remove them, add repository ignore rules for compiled test binaries and tmp/ files, then trace the automation behind the commit and add a pre-commit or CI guard if feasible.

Written by the indexing model from the issue text.