…ckpoint (#55)

## Summary

Reconciles the orphaned `estate-standardization-20260607` branch and
applies the 2026-06-12 governance checkpoint. Three commits:

1. **`3157d08` estate merge** — conflicts `.claude/CLAUDE.md` +
`rust-ci.yml` both resolved to main's versions (verified zero diff vs
main for both). Wave brings: `6a2/0-AI-MANIFEST.a2ml` + `6a2/anchor/`,
`agent_instructions/`→`bot_directives/`, `svc/k9/`→`self-validating/`,
flat contractiles, `GOVERNANCE.adoc`/`MAINTAINERS.adoc`/`CODEOWNERS`,
OpenSSF badge, plain-MPL-2.0 LICENSE, `flake.nix` removed (guix.scm
primary).
2. **`bda5afe`** codeql cron weekly→monthly (cherry-pick of
`cicd/codeql-cron-monthly`).
3. **`d2bdd55` checkpoint layer** (24 files, `.machine_readable/` + docs
only):
- 6a2 `STATE.a2ml` refreshed to 2026-06-12 with `[recent-work]` from the
real git log (PRs #27–#53); completion held honestly at 60% / CRG D.
- **Contractiles repopulated repo-true** — the estate stubs were
unadapted `rsr-template-repo` copies; ⚠️ critically, the stub had
**reverted the hardened crypto Trustfile from `minimal`/deny-by-default
back to `maximal`** — the hardened trust posture (no-key-material,
no-homerolled-hmac, MCP gating) is restored and preserved. Dustfile +
Bustfile fully written (n/a sections carry reasons).
- **`bot_directives/` trio** (hypatia / gitbot-fleet /
git-private-farm), never-touch list adapted to januskey (`src/abi/`,
`generated/idrisiser/`, threat-model, Trustfile).
- **`self-validating/`** fleshed out to the shared k9 template set
(januskey identity), keeping `januskey-metadata.k9.ncl` +
`threat-model.a2ml`.
- Wiki Home + README: "provably reversible"/"100% reversibility"
overclaims qualified per the repo's own corrected claims; broken
CONTRIBUTING link fixed.

## After merge — branches deletable (maintainer action)
`estate-standardization-20260607`, `cicd/codeql-cron-monthly`, **plus 4
verified byte-identical/superseded strays**:
`chore/scorecard-job-level-perms-282`,
`claude/changelog-seed-2026-05-26`, `claude/tech-debt-2026-05-26`,
`docs/claude-md-rescript-to-affinescript`. (#54 is dependabot's —
leave.)

## Flagged for maintainer
- `.claude/CLAUDE.md` needs 3 maintainer edits (agent-blocked): line ~46
leftover "ReScript"; stale "Fallback: Nix (flake.nix)"; "Guile Scheme —
State/meta" row describing `.a2ml` files.
- `TESTING-REPORT.scm` in repo root violates the repo's own MUST
invariant.
- `instant-sync.yml` lacks the `FARM_DISPATCH_TOKEN` presence gate.
- Estate contractile format note: canonical flat contractiles use the
estate DSL (not TOML) — kept as canonical for the 4 estate-supplied
ones, TOML for net-new; estate-wide format decision pending.

🤖 Draft — opened for review.

https://claude.ai/code/session_01GJatEm2TVFSTBEkKXmserJ

---
_Generated by [Claude
Code](https://claude.ai/code/session_01GJatEm2TVFSTBEkKXmserJ)_

---------

Co-authored-by: Mistral Vibe <vibe@mistral.ai>
Co-authored-by: Claude <noreply@anthropic.com>