fix(ci): estate-wide foundational remediation (#22)

Fixes Validate Hypatia Baseline, root shape files, and tar slashes in
release artifacts.

Author: hyperpolymath

.machine_readable/root-allow.txt

@@ -69,3 +69,6 @@ container/                 # may host Containerfile if not at build/
 .pre-commit-config.yaml    # TODO: relocate to ci/.pre-commit-config.yaml after invocation pattern decided
 affinescript/              # AffineScript source subtree consumed by this template
 tools/                     # TODO: consolidate with scripts/ or document the split (pending decision)
+.hypatia-ignore
+CLAUDE.md
+flake.nix