fix(k9): add K9! magic + pedigree blocks to satisfy dogfood-gate

The "Validate K9 contracts" job failed on three files:
- container/deploy.k9.ncl — missing K9! magic line; pedigree block had
  `name`/`version` only under nested `metadata`, not as direct fields,
  and the security block lacked a `leash`/`security_level`.
- coordination.k9 — no K9! magic, no pedigree block.
- session/custom-checks.k9 — no K9! magic, no pedigree block.

Fixes (modelled on the proven-passing hyperpolymath/echidna
container/deploy.k9.ncl):
- Prepend the literal `K9!` magic line (first non-empty line).
- Add SPDX-License-Identifier: MPL-2.0 within the first 10 lines.
- deploy.k9.ncl: add top-level `name`/`version` identity fields inside
  the `component_pedigree` block and a `leash = 'Hunt` to the security
  block. Check/contract logic unchanged.
- coordination.k9 / custom-checks.k9: add a minimal `pedigree = { ... }`
  block (name, schema_version, leash, security_level) ahead of the
  existing policy body. Policy content unchanged.

https://claude.ai/code/session_013wg3Mtq2QFhYi4XVw1Z6z7

Author: claude

container/deploy.k9.ncl

@@ -1,3 +1,4 @@
+K9!
 # SPDX-License-Identifier: MPL-2.0
 # deploy.k9.ncl — {{PROJECT_NAME}} deployment component (Hunt level)
 #
@@ -14,6 +15,14 @@
 
 # The component's pedigree (self-description across five layers)
 let component_pedigree = {
+  # Top-level identity fields — duplicated from metadata so the K9
+  # validator (which inspects the literal `pedigree = { ... }` block
+  # at the toplevel of the file rather than the resolved Nickel value)
+  # can locate name / version / security_level without resolving the
+  # `component_pedigree` indirection.
+  name = "{{SERVICE_NAME}}-deploy",
+  version = "{{VERSION}}",
+
   # ─────────────────────────────────────────────────────────────
   # L1: The Snout — Identity
   # ─────────────────────────────────────────────────────────────
@@ -39,6 +48,7 @@ let component_pedigree = {
   # L3: The Leash — Security
   # ─────────────────────────────────────────────────────────────
   security = {
+    leash = 'Hunt,
     trust_level = 'Hunt,
     allow_network = true,
     allow_filesystem_write = true,

coordination.k9

@@ -1,4 +1,17 @@
+K9!
+# SPDX-License-Identifier: MPL-2.0
 # Thin coordination bindings for central session-management standards
+#
+# K9 pedigree (required by hyperpolymath/k9-validate-action): the magic
+# first line above plus this pedigree block. Data-only policy binding —
+# no network/write/subprocess access.
+pedigree = {
+  name = "session-coordination",
+  schema_version = "1.0.0",
+  component_type = "session-coordination",
+  leash = "Kennel",
+  security_level = "data-only",
+}
 
 session_management:
   source_of_truth: "standards/session-management-standards"

session/custom-checks.k9

@@ -1,4 +1,18 @@
+K9!
+# SPDX-License-Identifier: MPL-2.0
 # Local repository session checks (thin policy layer)
+#
+# K9 pedigree (required by hyperpolymath/k9-validate-action): the magic
+# first line above plus this pedigree block. Data-only policy layer —
+# no network/write/subprocess access.
+pedigree = {
+  name = "session-custom-checks",
+  schema_version = "1.0.0",
+  component_type = "session-checks",
+  leash = "Kennel",
+  security_level = "data-only",
+}
+
 version: "0.1"
 
 checks: