fix(ci): resolve K9 contract baseline failure (Refs #87) (#113)

## Summary

`container/deploy.k9.ncl` was failing `hyperpolymath/k9-validate-action`
with two errors:

- `Missing K9! magic number. First non-empty line must be exactly 'K9!'`
— the file led with the SPDX header.
- `Pedigree block missing 'name' field (in pedigree.metadata.name or
pedigree.name)` — the metadata lived inside a separate `let
component_pedigree = { … }` binding which the validator's line-based
parser couldn't follow; only the eventual `pedigree =
component_pedigree,` line was visible.

## Fix

Restructured to the canonical shape (see
`.machine_readable/svc/k9/boj-server-metadata.k9.ncl`):

- `K9!` magic on line 1
- `pedigree = { metadata = { name, version, … }, security = { leash =
'Hunt, signature = … }, … }` inlined directly into the top-level export
- `deployment` and `scripts` remain in `let`-bindings outside the
pedigree block — the validator only inspects pedigree contents and the
top-level export shape is unchanged

## Important: not the standards#89 sub-issue 2 mask

The K9 Dogfood Gate is documented as "stays red until
http-capability-gateway tier-2 production-wired" (standards#89 sub-issue
2). That's about **gateway wiring** for consumer adapters. This PR fixes
a **contract-shape defect** on a single in-tree file — the file itself
was not a well-formed K9 manifest. The unwired-gateway tracking remains
untouched.

## Test plan

- [ ] CI: Dogfood Gate / `Validate K9 contracts` green
- [ ] Visual check: the other 4 K9 files
(`.machine_readable/svc/k9/*.k9.ncl`) continue to pass

Refs #87.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

container/deploy.k9.ncl

@@ -1,3 +1,4 @@
+K9!
 # SPDX-License-Identifier: PMPL-1.0-or-later
 # deploy.k9.ncl — Bundle of Joy Server deployment component (Hunt level)
 #
@@ -12,61 +13,6 @@
 #   k9-svc validate container/deploy.k9.ncl
 #   k9-svc deploy container/deploy.k9.ncl --env production
 
-# The component's pedigree (self-description across five layers)
-let component_pedigree = {
-  # ─────────────────────────────────────────────────────────────
-  # L1: The Snout — Identity
-  # ─────────────────────────────────────────────────────────────
-  metadata = {
-    name = "boj-server-deploy",
-    version = "0.1.0",
-    breed = "application/vnd.k9+nickel",
-    magic_number = "K9!",
-    description = "Bundle of Joy Server deployment component (Hunt level)",
-  },
-
-  # ─────────────────────────────────────────────────────────────
-  # L2: The Scent — Target Environment
-  # ─────────────────────────────────────────────────────────────
-  target = {
-    os = 'Linux,
-    is_edge = false,
-    requires_podman = true,
-    min_memory_mb = 256,
-  },
-
-  # ─────────────────────────────────────────────────────────────
-  # L3: The Leash — Security
-  # ─────────────────────────────────────────────────────────────
-  security = {
-    trust_level = 'Hunt,
-    allow_network = true,
-    allow_filesystem_write = true,
-    allow_subprocess = true,
-    # In production, replace with a real Ed25519 signature.
-    signature = "PLACEHOLDER-SIGNATURE-REQUIRED-FOR-HUNT",
-  },
-
-  # ─────────────────────────────────────────────────────────────
-  # L4: The Gut — Self-Validation
-  # ─────────────────────────────────────────────────────────────
-  validation = {
-    checksum = "sha256:placeholder",
-    pedigree_version = "1.0.0",
-    hunt_authorized = false,  # Must be set true after handshake
-  },
-
-  # ─────────────────────────────────────────────────────────────
-  # L5: The Muscle — Deployment Recipes
-  # ─────────────────────────────────────────────────────────────
-  recipes = {
-    install = "just container-build",
-    validate = "just container-verify",
-    deploy = "just container-up",
-    migrate = "just container-build && just container-up",
-  },
-} in
-
 # Deployment configuration
 let deployment = {
   # Target environments (dev / staging / production)
@@ -142,8 +88,64 @@ echo "K9: Rollback complete."
 } in
 
 # Export the component
+# The pedigree is inlined at the top level so the canonical
+# hyperpolymath/k9-validate-action regex finds
+#   pedigree = { … metadata = { name = …, version = … } … }
+# directly. Previously the metadata lived in a `let component_pedigree`
+# binding which was opaque to the line-based validator.
 {
-  pedigree = component_pedigree,
+  pedigree = {
+    schema_version = "1.0.0",
+    component_type = "deployment-component",
+    # ─────────────────────────────────────────────────────────────
+    # L1: The Snout — Identity
+    # ─────────────────────────────────────────────────────────────
+    metadata = {
+      name = "boj-server-deploy",
+      version = "0.1.0",
+      breed = "application/vnd.k9+nickel",
+      magic_number = "K9!",
+      description = "Bundle of Joy Server deployment component (Hunt level)",
+    },
+    # ─────────────────────────────────────────────────────────────
+    # L2: The Scent — Target Environment
+    # ─────────────────────────────────────────────────────────────
+    target = {
+      os = 'Linux,
+      is_edge = false,
+      requires_podman = true,
+      min_memory_mb = 256,
+    },
+    # ─────────────────────────────────────────────────────────────
+    # L3: The Leash — Security
+    # ─────────────────────────────────────────────────────────────
+    security = {
+      leash = 'Hunt,
+      trust_level = 'Hunt,
+      allow_network = true,
+      allow_filesystem_write = true,
+      allow_subprocess = true,
+      # In production, replace with a real Ed25519 signature.
+      signature = "PLACEHOLDER-SIGNATURE-REQUIRED-FOR-HUNT",
+    },
+    # ─────────────────────────────────────────────────────────────
+    # L4: The Gut — Self-Validation
+    # ─────────────────────────────────────────────────────────────
+    validation = {
+      checksum = "sha256:placeholder",
+      pedigree_version = "1.0.0",
+      hunt_authorized = false,  # Must be set true after handshake
+    },
+    # ─────────────────────────────────────────────────────────────
+    # L5: The Muscle — Deployment Recipes
+    # ─────────────────────────────────────────────────────────────
+    recipes = {
+      install = "just container-build",
+      validate = "just container-verify",
+      deploy = "just container-up",
+      migrate = "just container-build && just container-up",
+    },
+  },
   deployment = deployment,
   scripts = scripts,