Repo potential assessment: fix identity, purge template residue, green the governance CI (#41)

## Summary

bofj-kitt was scaffolded from the RSR template on 2026-03-16 and never
given its own identity. It carried **three contradictory identities**
(README/manifests said "pseudoscript"; Justfile/STATE said
"rsr-template-repo"; only `CLADE.a2ml` said "bofj-kitt"), ~88 files of
unfilled `{{TOKEN}}` placeholders, a vendored 4.9 MB copy of an
unrelated project (AffineScript, headless + AGPL-in-an-MPL-repo), and
governance CI that failed deterministically on several of its own estate
rules.

This PR brings the repo to an **honest baseline** (roadmap milestone
**M0**): one truthful identity everywhere, governance CI that passes its
own rules, and a committed assessment + M0–M5 roadmap. It adopts the
purpose from the GitHub description — **Shared Developer Environment
Extension Kit (the "SuperChainsaw") for the BoJ (Box of Justice)
server**. **No product code is written in this pass**; the kit is
specified as future work.

Full findings and rationale:
`docs/reports/audit/repo-assessment-2026-07-16.adoc`.

## Changes

- **Removed** the vendored `affinescript/` subtree (608 files, 4.9 MB)
and the uninstantiated `src/interface/` template ABI/FFI (the FFI never
compiled — it held literal `{{project}}` tokens as identifiers) plus
template-only test/bench/validation harnesses and the invalid `e2e.yml`.
- **Identity rewrite** to `bofj-kitt` across README,
`0-AI-MANIFEST.a2ml`, `STATE.a2ml`/`6a2/{STATE,ECOSYSTEM,META}.a2ml`,
`Justfile`, contractiles, `TOPOLOGY.adoc`, `ROADMAP.adoc`,
`TEST-NEEDS.adoc`, `EXPLAINME.adoc`, and onboarding docs. ADRs recorded
for the three decisions.
- **estate-rules green**: fixed root-shape allowlist (allow
`README.md`/`CONTRIBUTING.md`/`SECURITY.md`/`LICENSES/`; removed root
`.adoc` duplicates that have canonical copies under `docs/`); converted
the one `.md` under `docs/` to `.adoc`; scrubbed banned-language
references from ~30 template files.
- **openssf-compliance green**: filled the token-scanned manifests;
removed the 406-line unfilled `.github/SECURITY.md` in favour of the
real root `SECURITY.md`; filled `.envrc`, `.well-known/*`,
`FUNDING.yml`, `settings.yml`, `READINESS.adoc` header.
- **CI repairs**: fixed `dogfood-gate.yml` (was **invalid YAML** —
embedded Python fell out of its `run:` block); pointed `rhodibot.yml`'s
dead `workflow_run` trigger at the real workflow name; fixed
`crg-grade`/`crg-badge` to read `docs/status/READINESS.adoc`; retargeted
`codeql.yml` from `javascript-typescript` (gone) to `actions`.
- **Added** `docs/reports/audit/repo-assessment-2026-07-16.adoc` and an
M0–M5 roadmap.

## RSR Quality Checklist

### Required

- [ ] Tests pass (`just test` or equivalent) — no product tests yet
(pre-alpha); governance workflow/aspect checks unaffected
- [x] Code is formatted
- [x] Linter is clean (no new warnings or errors)
- [x] No banned language patterns — the pass **removes** the repo's
banned-language FFI
- [x] No `unsafe` blocks without `// SAFETY:` comments
- [x] No banned functions (`believe_me`, `unsafeCoerce`, `Obj.magic`,
`Admitted`, `sorry`)
- [x] SPDX license headers present on all new/modified source files
- [x] No secrets, credentials, or `.env` files included

### As Applicable

- [x] `.machine_readable/STATE.a2ml` updated (project state changed)
- [x] `.machine_readable/ECOSYSTEM.a2ml` updated (integrations changed)
- [x] `.machine_readable/META.a2ml` updated (ADRs added)
- [x] Documentation updated for user-facing changes (README, EXPLAINME,
onboarding)
- [x] `TOPOLOGY` updated (architecture rewritten for the kit)
- [ ] `CHANGELOG` or release notes updated — deferred to M1
- [x] New dependencies reviewed — none added

## Testing

Ran the estate gates locally against the tracked tree (CI-accurate):

- `scripts/check-root-shape.sh` — PASS (the only working-tree offender
is the gitignored, CI-absent `.claude/`)
- `scripts/check-no-md-in-docs.sh` — PASS
- `scripts/check-no-vlang.sh` — PASS on all tracked files (remaining
hits are confined to the gitignored `.claude/settings.local.json`)
- OpenSSF placeholder scan reproduced over its exact file list — 0
tokens; `.github/SECURITY.md` absent
- All 17 workflows parse and declare `jobs:` (PyYAML)
- `just crg-grade` reads `X` from `READINESS.adoc` (not the fallback)
- No `pseudoscript` identity residue in tracked files

## Screenshots

n/a

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01Xw37JPAVjBDvAKdBRGRqMx

---
_Generated by [Claude
Code](https://claude.ai/code/session_01Xw37JPAVjBDvAKdBRGRqMx)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.editorconfig

@@ -26,9 +26,6 @@ indent_size = 2
 [*.exs]
 indent_size = 2
 
-[*.zig]
-indent_size = 4
-
 [*.ada]
 indent_size = 3
 

.envrc

@@ -18,7 +18,7 @@ if has nix && [ -f flake.nix ]; then
 fi
 
 # Project environment variables
-export PROJECT_NAME="{{PROJECT_NAME}}"
+export PROJECT_NAME="bofj-kitt"
 export RSR_TIER="infrastructure"
 # export DATABASE_URL="..."
 # export API_KEY="..."

.github/FUNDING.yml

@@ -1,7 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
-# Funding platforms for {{OWNER}} projects
+# Funding platforms for hyperpolymath projects
 # See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository
 
-github: {{OWNER}}
-ko_fi: {{OWNER}}
-liberapay: {{OWNER}}
+github: hyperpolymath