chore(governance): adopt estate-standardization wave + 2026-06-12 checkpoint (6a2 refresh, contractiles, bot_directives) (#97)

## Summary

Reconciles the orphaned `estate-standardization-20260607` branch into
main and applies the 2026-06-12 governance checkpoint on top. Three
layers:

### 1. Estate-standardization merge (`05a22a8`)
The June-7 estate wave, merged clean (verified via `merge-tree` before
acting): new layout `6a2/0-AI-MANIFEST.a2ml` + `6a2/anchor/`,
`agent_instructions/`→`bot_directives/`, `svc/k9/`→`self-validating/`,
flat `contractiles/`, root
`GOVERNANCE.adoc`/`MAINTAINERS.adoc`/`.github/CODEOWNERS`, OpenSSF
badge, Guix-primary (`manifest.scm` added, `flake.nix` removed).
`.claude/CLAUDE.md` was restored to main's exact version (zero diff —
agent-config file is maintainer territory).

### 2. CodeQL cron (`1421a42`)
Cherry-pick of `cicd/codeql-cron-monthly`: weekly → monthly.

### 3. Governance checkpoint (`e14fdcf`)
- **6a2 refresh**: `STATE.a2ml` brought from 2026-04-04 to 2026-06-12
with `[recent-work]` derived from the actual 51-commit git log (MPL-2.0
migration, CI canonicalization, ReScript→AffineScript, estate merge);
honest blockers/next-actions; completion held at 50% (no
feature-progress evidence either way). `META`/`PLAYBOOK` refreshed;
`ANCHOR.a2ml` converted to TOML + 2026-06-12 realignment entry.
- **Contractiles rewritten repo-true** (the estate copies were unadapted
template stubs still saying "rsr-template-repo"):
Mustfile/Trustfile/Adjustfile/Intentfile port the old root
`*.contractile` content; **Dustfile + Bustfile fully written**
(deprecation register, rollback scenarios; `not-applicable` sections
carry reasons).
- **`bot_directives/` trio (net-new)**: `hypatia.a2ml`
(accepted-findings from the real `.hypatia-ignore`), `gitbot-fleet.a2ml`
(six-bot roster, branch policy, never-touch list),
`git-private-farm.a2ml` (instant-sync propagation contract, token by
NAME only).
- **Doc currency**: README (broken PMPL badge→MPL-2.0,
ReScript→AffineScript, honest status), ROADMAP contradiction fixed,
stale path pointers fixed.

All 13 touched `.a2ml` files parse as TOML. No source code changed by
the checkpoint layer (merge deltas are SPDX/timeout hygiene from the
sanctioned estate branch).

## After merge
Remote branches `estate-standardization-20260607` and
`cicd/codeql-cron-monthly` are fully contained here and can be deleted
(maintainer action — branch deletion isn't available from this session).

## Flagged for maintainer
- The estate wave's contractile files carry unadapted
`rsr-template-repo` identity wherever it merged as-is (e.g. echo-types
main) — possible rsr-template↔standards drift worth checking at the
template source.
- `instant-sync.yml` here lacks the `FARM_DISPATCH_TOKEN` presence gate
(oblibeny gained one in its #53); workflow edit left to maintainer.
- Follow-up issues proposed (will be filed separately):
`.hypatia-ignore` stale entry, root Justfile stub recipes,
changelog-reusable adoption, duplicate Justfiles.

🤖 Draft — opened for review.

https://claude.ai/code/session_01GJatEm2TVFSTBEkKXmserJ

---
_Generated by [Claude
Code](https://claude.ai/code/session_01GJatEm2TVFSTBEkKXmserJ)_

---------

Co-authored-by: Mistral Vibe <vibe@mistral.ai>
Co-authored-by: Claude <noreply@anthropic.com>

Author: 3 people

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,3 +1,7 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
 ---
 name: Bug report
 about: Create a report to help us improve

.github/ISSUE_TEMPLATE/custom.md

@@ -1,3 +1,7 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
 ---
 name: Custom issue template
 about: Describe this issue template's purpose here.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,3 +1,7 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
 ---
 name: Feature request
 about: Suggest an idea for this project

.github/workflows/boj-build.yml

@@ -7,6 +7,7 @@ on:
 jobs:
   trigger-boj:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

.github/workflows/casket-pages.yml

@@ -18,6 +18,7 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
@@ -109,6 +110,7 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     needs: build
     steps:
       - name: Deploy to GitHub Pages

.github/workflows/codeql.yml

@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'   # monthly 1st 06:00 UTC
 
 # Estate guardrail: cancel superseded runs so re-pushes / rebased PR
 # updates do not pile up queued runs against the shared account-wide
@@ -23,14 +23,20 @@ permissions:
 jobs:
   analyze:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       contents: read
       security-events: write
     strategy:
       fail-fast: false
       matrix:
         include:
-          - language: javascript-typescript
+          # maa-framework has no JavaScript/TypeScript source — the
+          # javascript-typescript extractor errors with "no source code seen"
+          # (exit 32, configuration error). CodeQL's GitHub Actions analysis
+          # scans the workflow YAML that does exist here, keeping this a
+          # meaningful security check (same fix as oblibeny's codeql.yml).
+          - language: actions
             build-mode: none
 
     steps:

.github/workflows/dogfood-gate.yml

@@ -22,6 +22,7 @@ jobs:
   a2ml-validate:
     name: Validate A2ML manifests
     runs-on: ubuntu-latest
+    timeout-minutes: 15
 
     steps:
       - name: Checkout repository
@@ -66,6 +67,7 @@ jobs:
   k9-validate:
     name: Validate K9 contracts
     runs-on: ubuntu-latest
+    timeout-minutes: 15
 
     steps:
       - name: Checkout repository
@@ -115,6 +117,7 @@ jobs:
   empty-lint:
     name: Empty-linter (invisible characters)
     runs-on: ubuntu-latest
+    timeout-minutes: 15
 
     steps:
       - name: Checkout repository
@@ -179,6 +182,7 @@ jobs:
   groove-check:
     name: Groove manifest check
     runs-on: ubuntu-latest
+    timeout-minutes: 15
 
     steps:
       - name: Checkout repository
@@ -237,6 +241,7 @@ jobs:
   dogfood-summary:
     name: Dogfooding compliance summary
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     needs: [a2ml-validate, k9-validate, empty-lint, groove-check]
     if: always()
 

.github/workflows/governance.yml

@@ -32,3 +32,4 @@ permissions:
 jobs:
   governance:
     uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613
+    timeout-minutes: 10

.github/workflows/hypatia-scan.yml

@@ -26,4 +26,5 @@ permissions:
 jobs:
   hypatia:
     uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@5eb28d7d8790d5389b7b6a5233fe6265a775e3d0
+    timeout-minutes: 10
     secrets: inherit

.github/workflows/instant-sync.yml

@@ -14,6 +14,7 @@ permissions:
 jobs:
   dispatch:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Trigger Propagation
         uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3