Fix/codegen k9 magic pedigree (#17)

* fix(codegen): emit K9! magic line + pedigree block (closes #8)

generate_k9_contract emitted `# Auto-generated…` as the first line and
no pedigree, so every generated .k9 failed the canonical
hyperpolymath/k9-validate-action:
  - Missing K9! magic number (first non-empty line must be 'K9!')
  - Missing pedigree block

Now emits `K9!` as the first line, an SPDX header, and a `pedigree`
block (schema_version + metadata.name + security.leash + signature_
required) — matching the template-<tier>.k9.ncl shape and satisfying
the validator's name(error)/version(warn)/leash(warn)/hunt-signature
checks. Verified end-to-end against k9-validate-action@2d96f43:
3 files scanned, 0 errors, 0 warnings.

Unit test strengthened: asserts K9! first line + pedigree fields.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(examples): remove orphaned ReScript web-example scaffold (Refs #8)

examples/SafeDOMExample.res `open`s a SafeDOM module that does not
exist anywhere in this repo, depends on the external ReScript repo
hyperpolymath/rescript-dom-mounter, is referenced by nothing, and was
only ever introduced by a bulk governance-bundle chore. Its partner
web-project-deno.json (self-described 'Example deno.json for ReScript
web projects', same dead safe-dom dep) is referenced by nothing.

This is dead estate ReScript-elimination drift in a Rust codegen repo,
not live code: there is nothing to port (no SafeDOM module, no consumer)
and the real k9iser example is examples/web-app/k9iser.toml. Removing
the orphaned scaffold is the resolve-at-source fix and clears the
Governance / language anti-pattern gate.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* ci(codeql): converge to canonical language-autodetect workflow (Refs #8)

k9iser's codeql.yml was a stale hardcoded `javascript-typescript`-only
matrix (left as a local security workflow by the b618a53 bundle
migration). On this Rust-only repo CodeQL exits with a permanent
false-red 'no source / configuration error' on the analyze job.

Replace it verbatim with the canonical estate template shipped by
rsr-template-repo / v3-templater / reposystem: a detect job reads the
repo's actual language stats and only analyses CodeQL-supported,
buildless-safe languages (here: rust), skipping entirely when none
apply. Also brings the estate concurrency guardrail (cancel superseded
runs). This is resolve-at-source + convergence to the central canonical
template rather than a k9iser-local divergence.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/codeql.yml

@@ -8,6 +8,12 @@ on:
     branches: [main, master]
   schedule:
     - cron: '0 6 * * 1'
+# Estate guardrail: cancel superseded runs so re-pushes don't pile up
+# queued runs across the estate. Safe here because this workflow only
+# performs read-only checks/lint/test/scan with no publish or mutation.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 # Estate guardrail: cancel superseded runs so re-pushes / rebased PR
 # updates do not pile up queued runs against the shared account-wide
@@ -21,17 +27,46 @@ permissions:
   contents: read
 
 jobs:
+  # The estate is heterogeneous (Rust, Idris2, Agda, Elixir, ReScript,
+  # occasional JS/TS/Python). A hard-coded `javascript-typescript` matrix
+  # made CodeQL exit with a "no source / configuration error" on every
+  # non-JS/TS repo — a permanent false-red `analyze` on most repos' main.
+  # Detect the languages the repo ACTUALLY contains and only analyse the
+  # CodeQL-supported, buildless-safe ones; skip entirely when none apply.
+  detect:
+    runs-on: ubuntu-latest
+    outputs:
+      langs: ${{ steps.pick.outputs.langs }}
+    steps:
+      - name: Pick CodeQL languages from repo language stats
+        id: pick
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          stats=$(gh api "repos/${{ github.repository }}/languages" --jq 'keys[]' 2>/dev/null || echo "")
+          out=""
+          add() { out="$out $1"; }
+          echo "$stats" | grep -qix 'Rust'                 && add rust
+          echo "$stats" | grep -qixE 'JavaScript|TypeScript' && add javascript-typescript
+          echo "$stats" | grep -qix 'Python'               && add python
+          echo "$stats" | grep -qix 'Ruby'                 && add ruby
+          echo "$stats" | grep -qix 'Go'                   && add go
+          arr=$(printf '%s\n' $out | grep . | sort -u | jq -R . | jq -s -c .)
+          [ -z "$arr" ] && arr='[]'
+          echo "Detected CodeQL languages: $arr"
+          echo "langs=$arr" >> "$GITHUB_OUTPUT"
+
   analyze:
+    needs: detect
+    if: needs.detect.outputs.langs != '[]'
     runs-on: ubuntu-latest
     permissions:
       contents: read
       security-events: write
     strategy:
       fail-fast: false
       matrix:
-        include:
-          - language: javascript-typescript
-            build-mode: none
+        language: ${{ fromJSON(needs.detect.outputs.langs) }}
 
     steps:
       - name: Checkout
@@ -41,7 +76,7 @@ jobs:
         uses: github/codeql-action/init@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3
         with:
           languages: ${{ matrix.language }}
-          build-mode: ${{ matrix.build-mode }}
+          build-mode: none
 
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3