feat: add sealed Containerfile (Nix-retirement escape hatch) (#19)

## Summary

- Nix was retired estate-wide 2026-06-01, so a bare `flake.nix` no
longer satisfies the governance CI gate. This adds a sealed, real
`Containerfile` at the repo root as the accepted escape hatch — every
`RUN` line is active (no commented examples, no `# TODO:` placeholders,
no `|| true` fake gates).
- Toolchain scope was measured, not guessed: this repo is overwhelmingly
a Just-orchestrated spec/docs/governance tree (127 `.adoc`, 118 `.a2ml`,
32 `.yml`, 20 `.sh`, vs. only 9 `.idr` and zero real, non-template
`.zig`). The Containerfile provisions and genuinely exercises that bulk
toolchain: `just`, `bash`, `git`, and GNU
`coreutils`/`findutils`/`grep`/`gawk`/`sed` (busybox's `find` lacks
`-printf`, which `scripts/check-root-shape.sh` needs).
- Real active build step: `RUN just --list --unsorted > /dev/null` — a
genuine smoke test that fails the build if the Justfile stops parsing
under the provisioned toolchain.
- Two-stage build (Wolfi build stage → Wolfi runtime stage, `USER
nonroot`), following the estate house style (see `aerie/Containerfile`,
`proven-servers/Containerfile`).
- `ENTRYPOINT ["just"]` / `CMD ["--list", "--unsorted"]` — running the
image lists the repo's Just recipes, which is the genuinely useful thing
this container can do (there is no compiled service binary in this
repo).

## Deliberate, documented exclusions (not stubs)

- **Idris2 is intentionally NOT provisioned.** `abi.ipkg` +
`src/interface/Abi/{Types,Layout,Foreign}.idr` are real, valid Idris2
with real ABI/layout proofs — but there is no Wolfi/Alpine `idris2`
package, and the only install path (`idris2-pack`) itself requires a
pre-installed Chez Scheme or Racket, neither of which has a Wolfi/Alpine
package either. I confirmed this by hand: building Chez Scheme from
source in a Wolfi container is the only remaining path, and it's a
10-30+ minute, fragile compile to serve 9 files out of a ~300-file tree
— disproportionate for this container. The header comment documents this
and points contributors who need the ABI proofs at upstream `pack` /
`idris2 --typecheck abi.ipkg` on a host that already has Scheme.
- **The Zig FFI side is out of scope too.** `src/interface/ffi/` is
still the RSR template's uninstantiated scaffold: `main.zig` keeps the
template's literal `{{project}}` placeholders (not valid Zig
identifiers), and `build.zig` deliberately wires up no build/test steps
yet.

## Verification

```
$ podman build -t contractiles-verify:latest -f Containerfile .
...
Successfully tagged localhost/contractiles-verify:latest
EXIT_CODE=0
```

Also ran `podman run --rm contractiles-verify:latest`, which correctly
lists the Justfile's recipes.

`flake.nix` is untouched — Guix is not yet a working dev environment for
this repo, so the Nix fallback needs to stay usable.

## Test plan

- [x] `podman build -t contractiles-verify:latest -f Containerfile .`
exits 0
- [x] `podman run --rm contractiles-verify:latest` lists Just recipes
correctly
- [ ] Maintainer confirms the toolchain scope (Just-only, no Idris2/Zig)
matches intent for this repo

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Mistral Vibe <vibe@mistral.ai>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: 3 people

.github/GOVERNANCE.md

@@ -0,0 +1,4 @@
+# Funding Configuration
+# See: https://docs.github.com/en/repositories/managing-your-repositorys-custom-fields/displaying-a-sponsor-button-in-your-repository
+
+github: metadatastician

.github/funding.yml

@@ -11,6 +11,7 @@ on:
     branches: [main, master]
   workflow_dispatch:
 permissions:
+  actions: read
   contents: read
 jobs:
   trigger-boj:

.github/workflows/boj-build.yml

@@ -8,6 +8,7 @@ on:
   schedule:
     - cron: '0 6 * * 1'
 permissions:
+  actions: read
   contents: read
 jobs:
   analyze:
@@ -32,11 +33,11 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@0d579ffd059c29b07949a3cce3983f0780820c98 # v3.28.1
+        uses: github/codeql-action/init@0d579ffd059c29b07949a3cce3983f0780820c98 # v3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@0d579ffd059c29b07949a3cce3983f0780820c98 # v3.28.1
+        uses: github/codeql-action/analyze@0d579ffd059c29b07949a3cce3983f0780820c98 # v3
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/codeql.yml

@@ -39,6 +39,7 @@ on:
   pull_request:
     types: [opened, reopened, synchronize]
 permissions:
+  actions: read
   contents: write # needed to enable auto-merge
   pull-requests: write # needed to approve
   # NB: keep narrow — do NOT add secrets: read or id-token: write here.

.github/workflows/dependabot-automerge.yml

@@ -13,6 +13,7 @@ on:
     branches: [main, master]
 
 permissions:
+  actions: read
   contents: read
 
 jobs:

.github/workflows/dogfood-gate.yml

@@ -29,6 +29,7 @@ on:
       - 'tests/**'
   workflow_dispatch:
 permissions: read-all
+  actions: read
 concurrency:
   group: e2e-${{ github.ref }}
   cancel-in-progress: true

.github/workflows/e2e.yml

@@ -15,6 +15,7 @@ on:
     branches: [main]
   pull_request:
 permissions:
+  actions: read
   contents: read
 jobs:
   estate-rules:

.github/workflows/estate-rules.yml

@@ -9,6 +9,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:

.github/workflows/governance.yml

@@ -12,6 +12,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 jobs:
   check: