… setup.sh, .envrc (#27)

Addresses the actionable subset of the Hypatia advisory findings surfaced by the
scanner upgrade in #26. The remaining ~7 are scanner false-positives (WF017 two-step
gate, SC-013 comment stripping, SC-014 codeql substring) for an upstream fix.

Docs (structural_drift SD022 x6 — stale path after #20's FFI removal):
- correct `src/abi/` -> the real RSR slot `src/interface/abi/` in AI-CONVENTIONS,
  RSR_OUTLINE, QUICKSTART-DEV, MAINTENANCE-CHECKLIST, INTENT.contractile
- replace the unfilled-template docs/developer/ABI-FFI-README.adoc (it still carried
  a `{{project}}` placeholder and a template-instruction line and described a
  non-existent FFI surface) with an honest "no FFI surface" stub pointing at the RSR
  placeholders and PROOF-NEEDS.md

setup.sh (code_safety shell_download_then_run / CWE-494):
- replace `curl ... just.systems/install.sh | bash` with a download-then-run helper
  (no pipe-to-shell), with opt-in JUST_VERSION pin and JUST_INSTALL_SHA256 verify;
  native package managers (incl. nix/guix) are still tried first
- update the header usage example to the download-then-run form

.envrc (secret_detected "Generic API key" — false-positive, commented placeholder):
- remove the residual `# export DATABASE_URL=...` / `# export API_KEY=...` lines
  (re-lands the fix intended in #25 that never reached main)

This does not by itself turn the hypatia check green — that needs the upstream
reusable to restore `--exit-zero`/`|| true` on the scan step so it follows its
documented advisory ("warn but don't fail") policy.


Claude-Session: https://claude.ai/code/session_01UCnxjXkN6uDj9YSANuGEgR

Co-authored-by: Claude <noreply@anthropic.com>

…ss); fix scorecard SPDX (#33)

standards/main was rebased/force-pushed, orphaning the d72fe5a pin set in #26 —
the workflow-staleness check now reports it as "not a recognised ancestor of
standards HEAD (09e7023d)". Re-pin the three callers to the current published
standards HEAD:

- governance.yml, hypatia-scan.yml, scorecard.yml: @d72fe5a14e84 -> @09e7023d2468

Also fix a stale SPDX header in scorecard.yml (PMPL-1.0 -> MPL-2.0; the repo
migrated to MPL-2.0 estate-wide).

Note: the hypatia check stays red until the advisory scan-guard is restored
upstream (tracked in #28); this only clears the staleness gate.


Claude-Session: https://claude.ai/code/session_01UCnxjXkN6uDj9YSANuGEgR

Co-authored-by: Claude <noreply@anthropic.com>