chore(governance): adopt estate-standardization wave + 2026-06-12 checkpoint (#55)

## Summary

Reconciles the orphaned `estate-standardization-20260607` branch and
applies the 2026-06-12 governance checkpoint. Three commits:

1. **`3157d08` estate merge** — conflicts `.claude/CLAUDE.md` +
`rust-ci.yml` both resolved to main's versions (verified zero diff vs
main for both). Wave brings: `6a2/0-AI-MANIFEST.a2ml` + `6a2/anchor/`,
`agent_instructions/`→`bot_directives/`, `svc/k9/`→`self-validating/`,
flat contractiles, `GOVERNANCE.adoc`/`MAINTAINERS.adoc`/`CODEOWNERS`,
OpenSSF badge, plain-MPL-2.0 LICENSE, `flake.nix` removed (guix.scm
primary).
2. **`bda5afe`** codeql cron weekly→monthly (cherry-pick of
`cicd/codeql-cron-monthly`).
3. **`d2bdd55` checkpoint layer** (24 files, `.machine_readable/` + docs
only):
- 6a2 `STATE.a2ml` refreshed to 2026-06-12 with `[recent-work]` from the
real git log (PRs #27–#53); completion held honestly at 60% / CRG D.
- **Contractiles repopulated repo-true** — the estate stubs were
unadapted `rsr-template-repo` copies; ⚠️ critically, the stub had
**reverted the hardened crypto Trustfile from `minimal`/deny-by-default
back to `maximal`** — the hardened trust posture (no-key-material,
no-homerolled-hmac, MCP gating) is restored and preserved. Dustfile +
Bustfile fully written (n/a sections carry reasons).
- **`bot_directives/` trio** (hypatia / gitbot-fleet /
git-private-farm), never-touch list adapted to januskey (`src/abi/`,
`generated/idrisiser/`, threat-model, Trustfile).
- **`self-validating/`** fleshed out to the shared k9 template set
(januskey identity), keeping `januskey-metadata.k9.ncl` +
`threat-model.a2ml`.
- Wiki Home + README: "provably reversible"/"100% reversibility"
overclaims qualified per the repo's own corrected claims; broken
CONTRIBUTING link fixed.

## After merge — branches deletable (maintainer action)
`estate-standardization-20260607`, `cicd/codeql-cron-monthly`, **plus 4
verified byte-identical/superseded strays**:
`chore/scorecard-job-level-perms-282`,
`claude/changelog-seed-2026-05-26`, `claude/tech-debt-2026-05-26`,
`docs/claude-md-rescript-to-affinescript`. (#54 is dependabot's —
leave.)

## Flagged for maintainer
- `.claude/CLAUDE.md` needs 3 maintainer edits (agent-blocked): line ~46
leftover "ReScript"; stale "Fallback: Nix (flake.nix)"; "Guile Scheme —
State/meta" row describing `.a2ml` files.
- `TESTING-REPORT.scm` in repo root violates the repo's own MUST
invariant.
- `instant-sync.yml` lacks the `FARM_DISPATCH_TOKEN` presence gate.
- Estate contractile format note: canonical flat contractiles use the
estate DSL (not TOML) — kept as canonical for the 4 estate-supplied
ones, TOML for net-new; estate-wide format decision pending.

🤖 Draft — opened for review.

https://claude.ai/code/session_01GJatEm2TVFSTBEkKXmserJ

---
_Generated by [Claude
Code](https://claude.ai/code/session_01GJatEm2TVFSTBEkKXmserJ)_

---------

Co-authored-by: Mistral Vibe <vibe@mistral.ai>
Co-authored-by: Claude <noreply@anthropic.com>

Author: 3 people

.github/CODEOWNERS

@@ -0,0 +1,34 @@
+# SPDX-License-Identifier: MPL-2.0
+# CODEOWNERS - Define code review assignments for GitHub
+# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+
+# Default: sole maintainer for all files
+* @hyperpolymath
+
+# Security-sensitive files require explicit ownership
+SECURITY.md @hyperpolymath
+.github/workflows/ @hyperpolymath
+.machine_readable/ @hyperpolymath
+contractiles/ @hyperpolymath
+
+# License files
+LICENSE @hyperpolymath
+LICENSES/ @hyperpolymath
+
+# Configuration
+.gitignore @hyperpolymath
+.github/ @hyperpolymath
+
+# Documentation
+README* @hyperpolymath
+CONTRIBUTING* @hyperpolymath
+CODE_OF_CONDUCT* @hyperpolymath
+GOVERNANCE* @hyperpolymath
+MAINTAINERS* @hyperpolymath
+CHANGELOG* @hyperpolymath
+ROADMAP* @hyperpolymath
+
+# Build and CI
+Justfile @hyperpolymath
+Makefile @hyperpolymath
+*.sh @hyperpolymath

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,3 +1,7 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
 ---
 name: Bug report
 about: Create a report to help us improve

.github/ISSUE_TEMPLATE/custom.md

@@ -1,3 +1,7 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
 ---
 name: Custom issue template
 about: Describe this issue template's purpose here.

.github/ISSUE_TEMPLATE/documentation.md

@@ -1,3 +1,7 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
 ---
 name: Documentation
 about: Report unclear, missing, or incorrect documentation

.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,3 +1,7 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
 ---
 name: Feature request
 about: Suggest an idea for this project

.github/ISSUE_TEMPLATE/question.md

@@ -1,3 +1,7 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
 ---
 name: Question
 about: Ask a question about usage or behaviour

.github/copilot/coding-agent.yml

@@ -0,0 +1,6 @@
+mcp_servers:
+  boj-server:
+    command: npx
+    args: ["-y", "@hyperpolymath/boj-server@latest"]
+    env:
+      BOJ_URL: http://localhost:7700

.github/workflows/boj-build.yml

@@ -7,6 +7,7 @@ on:
 jobs:
   trigger-boj:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

.github/workflows/cargo-audit.yml

@@ -20,6 +20,7 @@ permissions: read-all
 jobs:
   audit:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
 
@@ -35,6 +36,7 @@ jobs:
   # Optional: Create issues for vulnerabilities
   create-issue:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     needs: audit
     if: failure()
     permissions:

.github/workflows/casket-pages.yml

@@ -18,6 +18,7 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
@@ -109,6 +110,7 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     needs: build
     steps:
       - name: Deploy to GitHub Pages