chore(abi-drift): expand allowlist from 2 → 16 (full-tree survey) (#110)

## Summary

Full-tree survey of the 80 cartridges carrying paired `Safe*.idr` +
`*_ffi.zig` (standards#92 Phase 2 allowlist expansion, per epic
standards#89).

Adds 14 newly-audited-clean cartridges to the ABI Drift Gate allowlist
(`007-mcp`, `agent-mcp`, `dns-shield-mcp`, `feedback-mcp`, `fleet-mcp`,
`iac-mcp`, `k8s-mcp`, `local-coord-mcp`, `nesy-mcp`, `observe-mcp`,
`opsm-mcp`, `pmpl-mcp`, `proof-mcp`, `secrets-mcp`), bringing the gate
from 2 → 16 cartridges. The remaining 64 cartridges are either
drift-bearing or hit a verifier limit — see the standards#92 comment for
the full taxonomy.

## Method

For each of the 80 cartridges:

```bash
iseriser abi-emit-manifest --idris  $(ls cartridges/$cart/abi/*/Safe*.idr | head -n1) \
                            --cartridge $cart \
                            --source-path $(ls cartridges/$cart/abi/*/Safe*.idr | head -n1) \
                            --out /tmp/$cart.json
iseriser abi-verify --manifest /tmp/$cart.json --zig-ffi $(ls cartridges/$cart/ffi/*_ffi.zig | head -n1)
```

— exit 0 = allowlisted, exit 2 = drift, parse error = verifier limit.

## Test plan

- [x] All 16 allowlisted cartridges return exit 0 from `iseriser
abi-verify` against the Phase-1b emitter manifest of their own
`Safe*.idr`.
- [ ] CI green on the new allowlist.

## Drift breakdown (for context — not in this PR)

| Class | Count | Description | Action |
|---|---|---|---|
| A | ~50 | `Error → error → err`: manifest emitter does NOT apply the
iseriser#15 Zig reserved-word conversion that the FFI side does |
one-fix-many — file on iseriser |
| B | ~8 | Name-normalisation mismatches (`GitHub→git_hub` vs Zig
variant, `RabbitMQ→rabbit_mq` vs `rabbitmq`, similar for
`DynamoDB`/`UmsProject`) | converter rule (file on iseriser) |
| C | ~6 | Genuine missing-enum-in-Zig
(`cloud-mcp`/`comms-mcp`/`ml-mcp`/`research-mcp`/`gitlab-api-mcp`/`mongodb-mcp`
— Idris2 declares enums Zig doesn't have) | per-cartridge ABI gap |
| P | 5 | `bsp-mcp`/`container-mcp`/`dap-mcp`/`lsp-mcp`/`vault-mcp` —
verifier's Zig parser doesn't handle their switch arm form | file on
iseriser |
| E | 1 | `vordr-mcp` — Safe*.idr "data declaration has no `=`" |
per-cartridge Idris2 source fix |

Refs hyperpolymath/standards#92 (Phase 2 allowlist expansion).
Refs hyperpolymath/standards#89 (epic — sub-issue 3).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/abi-drift.yml

@@ -71,19 +71,32 @@ jobs:
       - name: Resolve cartridge allowlist
         id: discover
         # 80 cartridges in the tree carry a paired Safe*.idr + *_ffi.zig.
-        # The gate starts narrow: only cartridges audited and known clean
-        # against the Phase 1b emitter + Phase 1 verifier are enforced.
-        # Expand this list as cartridges are individually verified — the
-        # broader spot-check (PR body) found real drift (e.g. 007-mcp's
-        # `ToolRisk` enum) plus Zig-reserved-word false positives (e.g.
-        # `Error → err` in airtable-mcp / postgresql-mcp) that need the
-        # converter taught about Zig reserved words first.
+        # 16 cartridges are audited green against the Phase 1b emitter +
+        # Phase 1 verifier (full-tree survey, 2026-05-20). 63 carry real
+        # drift, 5 hit a verifier parser limit (non-canonical Zig switch
+        # arms — separately tracked), 1 has a malformed Idris2 source.
+        # See standards#92 for the survey + drift taxonomy. Expand this
+        # list as drift classes get resolved upstream.
         run: |
           set -euo pipefail
           {
             echo 'carts<<EOF'
-            echo 'ssg-mcp'
+            echo '007-mcp'
+            echo 'agent-mcp'
+            echo 'dns-shield-mcp'
+            echo 'feedback-mcp'
+            echo 'fleet-mcp'
+            echo 'iac-mcp'
+            echo 'k8s-mcp'
             echo 'k9iser-mcp'
+            echo 'local-coord-mcp'
+            echo 'nesy-mcp'
+            echo 'observe-mcp'
+            echo 'opsm-mcp'
+            echo 'pmpl-mcp'
+            echo 'proof-mcp'
+            echo 'secrets-mcp'
+            echo 'ssg-mcp'
             echo 'EOF'
           } >> "$GITHUB_OUTPUT"