… gate + semver policy (#41)

<!-- SPDX-License-Identifier: CC-BY-SA-4.0 -->
## Summary

Makes the registry *professionally validated* — the two critical
breakers were fixed in #40; this adds the CI + policy so future
malformed changes are caught. Tier-2 of the flagship/registry hardening
effort (gaps G23, G25, G29).

## Changes

- **`ci/validate.jl`** — two-layer validator:
- *Layer 1:* the canonical **`RegistryCI.test`** (the checker
`JuliaRegistries/General` uses). It distinguishes the expected
non-General `registry_deps` gap (deps like HTTP/JSON3/Zygote registered
in General) from a real tooling/API error — the latter is **fatal**, so
a broken invocation can't silently pass.
- *Layer 2* (TOML-stdlib, independent): (a) every Deps.toml name↔UUID vs
`Registry.toml` across all 37 packages; (b)
`Registry.toml`/`Package.toml` repo slug + `git remote` consistency; (c)
warn-only Compat.toml upper-bound advisory.
- **`.github/workflows/registry-validate.yml`** — always-triggering CI
(no `on.*.paths`, per the estate required-check rule); the
General-`registry_deps` path is gated + `continue-on-error` (egress is
restricted in-sandbox, unrestricted in Actions).
- **`docs/REGISTRY-POLICY.adoc`** + **`docs/decisions/0001-…adoc`** —
semver bump rules, mandatory upper-bounded compat, name/UUID
immutability, and an auto-merge vs BDFL-review table; the first ADR
(GOVERNANCE referenced `docs/decisions/` which didn't exist — **closes
G29**). `GOVERNANCE.adoc` links the policy.
- **`tests/idris2/ValidateTest.idr`** — repaired 4 stale `README.adoc`
references to `README.md` (README was converted to Markdown in
`e0903a9`; this suite was never updated).

## RSR Quality Checklist

### Required
- [x] No banned language patterns (Julia validator + YAML + AsciiDoc)
- [x] SPDX headers on all new files (MPL-2.0 code / CC-BY-SA-4.0 docs) —
verified
- [x] No secrets, credentials, or `.env` files
- [ ] CI green — pending (draft; the new validator + existing gates will
run)

### As Applicable — Registry Changes
- [x] Per-package TOML consistency — now enforced in CI (name↔UUID +
repo slug across 37 packages)
- [ ] `Registry.toml` index updated for a package/version — N/A
(tooling/policy only)

### As Applicable — Documentation / Infra Changes
- [x] Policy doc + first ADR added; `GOVERNANCE.adoc` updated to link it

## Testing

Independently re-run (not self-graded by the worker):
```
julia ci/validate.jl  →  VALIDATION PASSED (exit 0)
  RegistryCI layer status: expected_general_gap   (ran; 23 "failures" are all General-registry dep UUIDs, expected)
  Layer 2a: 191 name↔UUID pairs across 37 packages — 0 mismatches
  Layer 2b: Registry.toml slug "hyperpolymath/julia-professional-registry" == git remote — 0 owner mismatches
  Layer 2c: 0 unbounded Compat.toml entries
```
The worker also adversarially corrupted scratch copies to confirm each
Layer-2 check fails (exit 1) as designed.

## Residuals (tracked)
- **RegistryCI.AutoMerge** bot-driven PR automation (needs a GitHub
token + a scope decision on bot- vs human-executed policy rows) — noted
in the ADR/policy as a follow-up.
- The Idris2 suite content bug is fixed but the suite still isn't
invoked by any workflow (no `idris2` bootstrap here) — flagged honestly,
not faked.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01UPFC9YQ7g9gc3VnRox42Q1

---
_Generated by [Claude
Code](https://claude.ai/code/session_01UPFC9YQ7g9gc3VnRox42Q1)_

Co-authored-by: Claude <noreply@anthropic.com>