ci: consolidate Haec gates, repair K9 envelopes and FFI validation (#27)

## What this is

Previously-unpushed work that existed **only** in a local worktree whose
`.git`
pointer was broken (it referenced a stale duplicate clone at
`hyper-repos/haec` that has since been deleted). Repaired with
`git worktree repair` and pushed here so it is no longer a single local
copy.

36 files, ~610 insertions / ~1265 deletions, in two commits:

- **`5c25f99`** — consolidates `dogfood-gate.yml` (453 lines → net −310)
and
  repairs the K9 contract envelopes (`coordination.k9`,
  `session/custom-checks.k9`, `methodology-guard.k9.ncl`, six
  `template-*`/example `.k9.ncl` files).
- **`e5c86e8`** — consolidates gate workflows into `ci.yml`; removes
`dependabot-automerge.yml`, `quality.yml`, `pages.yml`,
`security-policy.yml`,
`npm-bun-blocker.yml`, `hypatia-scan.yml`, `push-email-notify.yml`;
trims
  `dependabot.yml`; and reworks the **Zig/Idris FFI validation**
  (`src/interface/Abi/Foreign.idr`, `ffi/build.zig`, `ffi/src/main.zig`,
`ffi/test/integration_test.zig`), plus `Justfile` and test-script
updates.

## ⚠️ Not mergeable as-is

Conflicts with #22–#24 on six files, because those PRs added SPDX
headers to
workflows this branch deletes:

```
CONFLICT (content)        .github/workflows/governance.yml
CONFLICT (modify/delete)  .github/workflows/hypatia-scan.yml
CONFLICT (modify/delete)  .github/workflows/pages.yml
CONFLICT (content)        .github/workflows/release.yml
CONFLICT (modify/delete)  .github/workflows/rsr-antipattern.yml
CONFLICT (content)        .github/workflows/trope-check.yml
```

The modify/delete cases resolve trivially (keep the delete); the three
content
conflicts need review.

## Relationship to #26

The three `startup_failure` deletions have been **split out into #26**,
which
merges cleanly and fixes the red CI on its own. Rebase this branch on
top of #26
once that lands; the deletions will then already be in the base.

Left as **draft** pending conflict resolution and review of the FFI
rewrite.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/dependabot.yml

@@ -1,57 +1,17 @@
 # SPDX-License-Identifier: MPL-2.0
-# Dependabot configuration for RSR-compliant repositories
-# Covers common ecosystems - remove unused ones for your project
+# Dependabot configuration for Haec's current dependency surface.
 
 version: 2
 updates:
-  # GitHub Actions - always include
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+      day: "wednesday"
+      time: "13:37"
+      timezone: "Europe/London"
+    open-pull-requests-limit: 1
     groups:
       actions:
         patterns:
           - "*"
-
-  # Rust/Cargo
-  #
-  # `open-pull-requests-limit: 0` suppresses routine version-update PRs
-  # (no weekly patch-bump noise) while leaving Dependabot SECURITY PRs
-  # flowing. Under GitHub's current Dependabot behaviour (2024+), using
-  # an `ignore:` rule with `version-update:semver-patch` would ALSO
-  # silence security PRs that happen to be patch-level — historically
-  # the cause of estate-wide vulns sitting un-PR'd for weeks.
-  # `open-pull-requests-limit: 0` is the GitHub-endorsed way to say
-  # "security only, not routine bumps". Pair with the
-  # dependabot-automerge.yml workflow for low-touch security
-  # maintenance.
-  - package-ecosystem: "cargo"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 0
-
-  # Elixir/Mix
-  - package-ecosystem: "mix"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-
-  # Node.js/npm
-  - package-ecosystem: "npm"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-
-  # Python/pip
-  - package-ecosystem: "pip"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-
-  # Nix flakes
-  - package-ecosystem: "nix"
-    directory: "/"
-    schedule:
-      interval: "weekly"

.github/workflows/ci.yml

@@ -0,0 +1,65 @@
+# SPDX-License-Identifier: MPL-2.0
+name: "CI / required"
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  required:
+    name: "CI / required"
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    container:
+      # Idris 2 0.7.0, pinned by immutable image digest.
+      image: ghcr.io/stefan-hoeck/idris2-pack@sha256:de9781906050dc44704ec6de0108c86f899ef17b2642932b79e00245d613b8ad
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Zig
+        uses: goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406 # v2.2.1
+        with:
+          version: 0.15.2
+
+      - name: Typecheck the Idris2 ABI
+        shell: bash
+        run: |
+          set -euo pipefail
+          idris2 --version | grep -Fx 'Idris 2, version 0.7.0'
+          idris2 --typecheck abi.ipkg
+
+      - name: Compile and test the Zig FFI
+        shell: bash
+        run: |
+          set -euo pipefail
+          test "$(zig version)" = '0.15.2'
+          zig fmt --check \
+            src/interface/ffi/build.zig \
+            src/interface/ffi/src/main.zig \
+            src/interface/ffi/test/integration_test.zig
+          (
+            cd src/interface/ffi
+            zig build --summary all
+            zig build test --summary all
+          )
+
+      - name: Validate repository contracts
+        shell: bash
+        run: |
+          set -euo pipefail
+          find tests scripts -type f -name '*.sh' -print0 \
+            | xargs -0 -r bash -n
+          bash tests/check-examples.sh
+          bash tests/aspect_tests.sh
+          bash scripts/check-root-shape.sh .
+          bash tests/workflows/validate_workflows_test.sh

.github/workflows/codeql.yml

@@ -9,6 +9,9 @@ on:
     - cron: '0 6 * * 1'
 permissions:
   contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 jobs:
   analyze:
     runs-on: ubuntu-latest