fix(validate-a2ml): treat whole .machine_readable/ tree as structural-identity (#12)

The identity check exempted only `.machine_readable/6a2/` typed manifests,
on the rationale that their identity is structural (owning repo + path +
filename) rather than an in-file `name`/`agent-id` key. That rationale
applies to the entire `.machine_readable/` tree, not just `6a2/`:
CLADE.a2ml, ANCHOR.a2ml, STATE/ECOSYSTEM, agent_instructions/{debt,
coverage,methodology}, ai/AI, policies/*, integrations/* are all typed
agent-readable docs authored without an in-file identity key.

rsr-template-repo — the canonical source every RSR repo is built from —
itself ships these files without an identity key, so the old check
produced estate-wide false positives on every consumer (e.g. idaptik#77:
15 errors, of which 10 were already-fixed false positives and the
remaining 5 were these canonical .machine_readable/ docs).

Generalises the existing `6a2/` exemption to the whole tree. Files
outside `.machine_readable/` are still validated (verified: rsr-template
still flags its 3 non-tree docs; a2ml-validate-action still flags its
docs/governance/*). Purely subtractive — adds an exemption, cannot
introduce new errors.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

validate-a2ml.sh

@@ -173,12 +173,27 @@ validate_a2ml() {
         is_contractile_shape=true
     fi
 
-    if [[ "$has_identity" == "false" && "$is_manifest" == "false" && "$is_contractile_shape" == "false" ]]; then
+    # Canonical structured A2ML tree. Everything under a `.machine_readable/`
+    # directory is a typed agent-readable doc (CLADE, ANCHOR, STATE,
+    # ECOSYSTEM, agent_instructions/{debt,coverage,methodology}, ai/AI,
+    # policies/*, integrations/*, …). Per the RSR convention these carry
+    # identity structurally — owning repo + path + filename — not via an
+    # in-file `name`/`agent-id`. This generalises the `.machine_readable/6a2/`
+    # rationale above to the whole tree: rsr-template-repo itself ships these
+    # files without an in-file identity key, so requiring one produces
+    # estate-wide false positives on every repo built from the canonical
+    # template. Files outside `.machine_readable/` are still validated.
+    local is_structural_identity=false
+    if [[ "$file" == *"/.machine_readable/"* || "$file" == "./.machine_readable/"* || "$file" == ".machine_readable/"* ]]; then
+        is_structural_identity=true
+    fi
+
+    if [[ "$has_identity" == "false" && "$is_manifest" == "false" && "$is_contractile_shape" == "false" && "$is_structural_identity" == "false" ]]; then
         report_issue "error" "$file" 1 \
             "Missing required identity field (agent-id, name, or project)"
     fi
 
-    if [[ "$has_version" == "false" && "$is_manifest" == "false" && "$is_contractile_shape" == "false" ]]; then
+    if [[ "$has_version" == "false" && "$is_manifest" == "false" && "$is_contractile_shape" == "false" && "$is_structural_identity" == "false" ]]; then
         report_issue "warning" "$file" 1 \
             "Missing version or schema_version field"
     fi