Chore/rust ci reusable wrapper (#19)

* ci(rust): convert rust-ci.yml to thin wrapper (standards#174)

Replaces the per-repo `rust-ci.yml` copy with a 5-line wrapper invoking
the shared reusable workflow in `hyperpolymath/standards` (PR #174).

Pinned to PR #174's HEAD SHA `4fdf4314b4ab54269adbaff10e30e483b5e86845`; will resolve to standards/main
once #174 merges.

Estate audit found ~87 rust-ci.yml copies across the estate; this is
one of them. The reusable provides identical cargo check/clippy/fmt/test
behaviour with opt-in `enable_audit` + `enable_coverage` inputs.

Pattern precedent: standards#168 (governance-reusable) + downstream
wrappers absolute-zero#41 + tma-mark2#41.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(ci): unblock PR #11 — fix CodeQL matrix, workflow lint, drop ReScript example

Resolves the three persistent red checks on this PR:

1. **CodeQL Security Analysis** (was: `analyze (javascript-typescript, none)`)
   The default scaffolded matrix scanned `javascript-typescript`, but this
   repo has zero JS/TS source — every run exited with `Only found
   JavaScript or TypeScript files that were empty or contained syntax
   errors`. Switched the matrix to `actions` (per hypatia rule
   `codeql_language_matrix_mismatch`), which scans workflow files and
   succeeds on every repo.

2. **Governance / Workflow security linter**
   `k9-svc-validation.yml` was missing the SPDX header and top-level
   `permissions:` declaration that the standards governance bundle
   requires of every workflow. Added SPDX, `permissions: contents: read`,
   pinned `actions/checkout` to its v6.0.2 SHA, fixed the broken
   `set -euo` (was missing `pipefail`), removed non-ASCII glyphs.

3. **Governance / Language / package anti-pattern policy**
   `examples/SafeDOMExample.res` was the last ReScript file in the repo
   and tripped the estate-wide ReScript ban (banned in favour of
   AffineScript). Replaced with the canonical `SafeDOMExample.affine`
   (byte-identical to the one landed in `burble#92`,
   `gitbot-fleet#210`, `claude-gecko#30`, which were sweep-migrated
   under `gitbot-fleet#208`).

This repo was missed by the original sweep — see the project-memory
remediation for the recurrence rules being filed to prevent this.

Refs hyperpolymath/gitbot-fleet#208, #210; metadatastician/burble#92.

* ci: re-trigger workflows after branch-protection phantom-context cleanup

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath