fix(validate-a2ml): recognise contractile-shape A2ML files (#9)

The script's identity / version check assumed every `.a2ml` file uses
TOML `key = value` form. Contractile-shape files (Trustfile.a2ml,
Intentfile.a2ml, Mustfile.a2ml, Adjustfile.a2ml, …) use `@directive:`
syntax instead — their identity lives in `@trust-level`, `@intent`,
`@abstract` etc., not in `name = "..."` / `version = "..."`. As a
result every contractile file in a consumer repo failed validation
("Missing required identity field"), blocking Dependabot PRs across
the fleet.

Detect contractile shape by the presence of any of:
  @abstract, @trust-level, @trust-boundary, @trust-actions,
  @trust-deny, @intent, @must, @adjust, @EnD
in the file body, then skip the manifest-style identity / version
checks (parallel to the existing `*AI-MANIFEST*` special-case for
markdown-style manifests). Attestation-block and section-heading
checks (Checks 3 and 4) remain applied — they're shape-agnostic.

Closes the validate-A2ML-manifest failures observed on every Dependabot
PR across chimichanga, gitbot-fleet, idaptik, ambientops, and more
(reported by hyperpolymath/hypatia#23 audit as `Validate A2ML manifests`
class — 10 PRs blocked at audit time).

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

Author: hyperpolymath

validate-a2ml.sh

@@ -146,12 +146,25 @@ validate_a2ml() {
         is_manifest=true
     fi
 
-    if [[ "$has_identity" == "false" && "$is_manifest" == "false" ]]; then
+    # Contractile-shape A2ML files use `@directive:` syntax instead of
+    # TOML `key = value`. Trustfile.a2ml, Intentfile.a2ml, Mustfile.a2ml,
+    # Adjustfile.a2ml etc. are policy / trust / intent / abstract files
+    # whose identity is implicit in their @-prefixed directives
+    # (`@trust-level`, `@intent`, ...) rather than a TOML name/version
+    # pair. Treating them as manifest-shape produces 100% false positives —
+    # they're a different A2ML doc type. Detected by the presence of any
+    # contractile directive in the file body.
+    local is_contractile_shape=false
+    if grep -qE '^@(abstract|trust-level|trust-boundary|trust-actions|trust-deny|intent|must|adjust|end)([[:space:]]*:|$)' "$file"; then
+        is_contractile_shape=true
+    fi
+
+    if [[ "$has_identity" == "false" && "$is_manifest" == "false" && "$is_contractile_shape" == "false" ]]; then
         report_issue "error" "$file" 1 \
             "Missing required identity field (agent-id, name, or project)"
     fi
 
-    if [[ "$has_version" == "false" && "$is_manifest" == "false" ]]; then
+    if [[ "$has_version" == "false" && "$is_manifest" == "false" && "$is_contractile_shape" == "false" ]]; then
         report_issue "warning" "$file" 1 \
             "Missing version or schema_version field"
     fi