fix(ci): Bun-first runtime policy; retire two gates that enforced the opposite

Authority: standards LANGUAGE-POLICY.adoc §1 (added 2026-07-29) --
Bun > Deno > pnpm > npm.

REPLACED npm-bun-blocker.yml -> runtime-policy.yml
  The old gate failed any build carrying bun.lockb with 'npm/bun artifacts
  detected. Use Deno instead.' It blocked what is now the FIRST-choice runtime
  and mandated the second. Present in 55 repos; zero repos had adopted Bun,
  because adopting it would have turned them red.

  The replacement fails on something real -- MIXED TOOLCHAINS, two package
  managers' lockfiles in one repo, i.e. two dependency graphs that can disagree
  -- and reports the tier in use otherwise. npm is tier 4 but PERMITTED, so it
  warns rather than blocks.

  Red-teamed both directions before shipping: none/bun/deno/npm alone -> exit 0;
  bun+npm and deno+pnpm -> exit 1.

DELETED ts-blocker.yml
  It enforced 'use ReScript instead'. ReScript is itself retired estate-wide, so
  it policed a dead alternative. Worse, it could not fail: it diffed
  git diff HEAD~1 on a depth-1 checkout, where HEAD~1 does not exist, sent the
  error to /dev/null and used || true -- so the match set was ALWAYS empty.
  Measured 20/20 runs green; it has never once fired.

Neither workflow is a required status check in any ruleset, so removing them
creates no phantom context.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/npm-bun-blocker.yml

@@ -0,0 +1,71 @@
+# SPDX-License-Identifier: MPL-2.0
+# Runtime and package-manager policy check.
+#
+# Authority: hyperpolymath/standards LANGUAGE-POLICY.adoc §1.
+# Ordering:  Bun (1st) > Deno (2nd) > pnpm (3rd) > npm (last resort).
+#
+# REPLACES npm-bun-blocker.yml, which failed any build carrying `bun.lockb` with
+# the message "npm/bun artifacts detected. Use Deno instead." That gate blocked
+# what is now the FIRST-choice runtime and mandated the second. It was present in
+# 55 repositories.
+#
+# What this fails on, deliberately:
+#   MIXED TOOLCHAINS -- two different package managers' lockfiles in one repo.
+#   That is real, actionable drift: two dependency graphs that can disagree.
+# What it does NOT fail on:
+#   Using bun, deno, pnpm or npm. npm is LAST but PERMITTED; the check reports
+#   the tier in use so drift is visible without blocking legitimate work.
+name: Runtime Policy
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  runtime-policy:
+    name: Runtime Policy
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Report runtime tier and reject mixed toolchains
+        run: |
+          set -euo pipefail
+
+          bun=0; deno=0; pnpm=0; npm=0
+          [ -f bun.lockb ] || [ -f bun.lock ]                 && bun=1  || true
+          [ -f deno.lock ] || [ -f deno.json ] || [ -f deno.jsonc ] && deno=1 || true
+          [ -f pnpm-lock.yaml ]                               && pnpm=1 || true
+          [ -f package-lock.json ]                            && npm=1  || true
+
+          total=$((bun + deno + pnpm + npm))
+
+          if [ "$total" -eq 0 ]; then
+            echo "::notice::No JS/TS package manager in use — nothing to check."
+            exit 0
+          fi
+
+          # Report the tier actually in use (LANGUAGE-POLICY.adoc §1).
+          [ "$bun"  -eq 1 ] && echo "Bun   — tier 1 (preferred)"
+          [ "$deno" -eq 1 ] && echo "Deno  — tier 2 (accepted; existing projects are grandfathered)"
+          [ "$pnpm" -eq 1 ] && echo "pnpm  — tier 3"
+          [ "$npm"  -eq 1 ] && echo "::warning::npm lockfile present. npm is tier 4, the last resort — permitted, never preferred. See LANGUAGE-POLICY.adoc §1."
+
+          if [ "$total" -gt 1 ]; then
+            echo "::error::Mixed toolchains: $total package managers have lockfiles in this repository."
+            echo "Two dependency graphs that can disagree is real drift. Pick one — preferring the"
+            echo "highest tier present — and delete the others' lockfiles."
+            exit 1
+          fi
+
+          echo "✅ Single package manager in use."