fix(baseline): repair main + estate-policy sweep (unblocks #41) (#42)

## Summary

Five failing checks on PR #41 (and three on `main` since 2026-05-22)
were five distinct root causes. Each fixed at source:

| # | Failing check | Root cause | Fix |
|---|---|---|---|
| 1 | `governance / Language / package anti-pattern policy` | 3 orphan
`.res` files (no callers, no rescript.json) | Delete all 3 + the empty
`interpreters/rescript/` dir |
| 2 | `build` (×2) | `deno lint --config deno.json` → \"No target files
found\" (lint.include lists non-existent `mod.ts`) | Delete dead
`rescript-deno-ci.yml` workflow |
| 3 | `PR (address)` (ClusterFuzzLite) | `fuzz/Cargo.toml` declares
`[dependencies.absolute_zero]` but parent has no `[lib]` target | Remove
dead dep (fuzz_input.rs imports nothing from parent) |
| 4 | `governance / Workflow security linter` | 3 workflows missing
top-level `permissions:` | Add `permissions: contents: read` to
`language-policy.yml` + `rust-ci.yml` (3rd was the deleted
rescript-deno-ci.yml) |
| 5 | `Cargo.toml license = \"MIT\"` | Stale | Bump to `MPL-2.0` |

## Estate-policy sweep (per this session's instructions)

- **PMPL-1.0 / PMPL-1.0-or-later → MPL-2.0** across 67 files. PMPL isn't
a real SPDX identifier and the Palimpsest-MPL framing is retired.
README's License badge URL updated to match.
- **MPL-2.0-or-later → MPL-2.0** across 18 files (also not a valid SPDX
form — MPL-2.0 has no `-or-later` variant).
- `.claude/CLAUDE.md` language policy table updated: AffineScript is now
primary; ReScript and TypeScript are banned (replacement: AffineScript);
MPL-2.0 is the only allowed license. Previous version still said
\"ReScript Primary application code\" and \"Convert existing TS to
ReScript\".

## What's NOT in this PR (deliberately)

- **`examples/javascript/nop.js`** is kept. It's one of 30+ per-language
CNO reference implementations (alongside `examples/ada/`, `examples/c/`,
`examples/cobol/`, etc.). The whole point is JS-specific runtime
behavior; migrating to AffineScript would lose the language comparison.
- **`license/PMPL-1.0.txt`** (the old license file) is kept. Removing it
would be larger doc cleanup than this PR's scope.
- **Branch protection** on main — same gap as `r-g-t-v#89`. No
`required_status_checks` block, so red-CI merges are possible.
Owner-level `gh api -X PUT` change. Flagged separately; Hypatia PR #316
(BH001) detects this estate-wide.

## Test plan

- [x] `cargo build --release` (root crate) — passes
- [x] `cd fuzz && cargo check` — passes (was the cflite failure mode)
- [x] All three deleted `.res` files had zero in-repo references (`grep
-rln`)
- [x] Zero `PMPL-1.0` / `MPL-2.0-or-later` refs remain (other than the
policy doc itself naming the banned forms)
- [x] All workflows still parse (yaml syntax preserved)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.claude/CLAUDE.md

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 FROM gcr.io/oss-fuzz-base/base-builder-rust@sha256:73c1d5648db54100639339d411a5d192cbc8bf413ee91e843a07cf6f0e319dc7
 
 COPY . $SRC/absolute-zero

.clusterfuzzlite/Dockerfile

@@ -1,7 +1,11 @@
 #!/bin/bash -eu
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 cd "$SRC"/absolute-zero
 cargo +nightly fuzz build
+# cargo-fuzz writes binaries to `fuzz/target/<triple>/release/<target>`
+# (the fuzz crate's own target dir), not to the workspace root. The
+# previous `./target/...` path was a vestige of an earlier layout where
+# fuzz/ depended on the parent crate's `[lib]` (since removed).
 for target in $(cargo +nightly fuzz list); do
-    cp ./target/x86_64-unknown-linux-gnu/release/$target $OUT/
+    cp fuzz/target/x86_64-unknown-linux-gnu/release/$target $OUT/
 done

.clusterfuzzlite/build.sh

@@ -1,2 +1,2 @@
-# SPDX-License-Identifier: MPL-2.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 language: rust

.clusterfuzzlite/project.yaml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: MPL-2.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Funding platforms for hyperpolymath projects
 # See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository
 

.github/FUNDING.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: MPL-2.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 version: 2
 updates:
   - package-ecosystem: "cargo"

.github/dependabot.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: MPL-2.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: ClusterFuzzLite batch fuzzing
 on:
   schedule:

.github/workflows/cflite_batch.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: MPL-2.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: ClusterFuzzLite PR fuzzing
 on:
   pull_request:

.github/workflows/cflite_pr.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: MPL-2.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: CodeQL Security Analysis
 
 on:

.github/workflows/codeql.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # governance.yml — single wrapper calling the shared estate governance bundle
 # in hyperpolymath/standards instead of carrying per-repo copies.
 #