Pivot to a deterministic policy engine; ship engine v0 (v0.2.0) (#43)

* Pivot to a deterministic policy engine; ship engine v0 (v0.2.0)

palimpsest-plasma is now a deterministic, typed policy engine for the
agentic era, not a PMPL governance toolkit. Write machine-readable deontic
policies and evaluate repositories against them with reproducible results.

Engine v0 (new plasma-engine crate):
- Typed policy AST (subjects, resources, composable conditions, deontic
  modalities, overlays) transposed from docs/policy-ast-v0.1.adoc to Rust
- Versioned TOML/JSON schema loading with load-time rejection of reserved
  constructs, so evaluation is total
- Deterministic fact collection (files, SPDX headers, Cargo version, git
  HEAD) as the sole impure boundary
- Pure evaluator implementing the deontic matrix; BTree ordering gives
  byte-identical output for identical inputs
- Human, JSON, and SARIF 2.1.0 renderers with a stable plasma/<rule-id>
  namespace for sibling tooling
- Bundled repo-hygiene policy; the repo checks itself in CI

CLI:
- New: plasma check / facts / policy validate
- audit rewired onto plasma-parser (real SPDX parsing, .plasma.toml zones)
  via a new scan_repo; init/migrate/badge genericized to any SPDX license
- binary renamed palimpsest-plasma -> plasma

Truth + green:
- Build fixed (init/migrate embedded a nonexistent license file); SPDX
  catalog PMPL/PPMPL drift fixed (2 tests); 66 tests pass; clippy clean
- Licensing unified: code MPL-2.0, docs CC-BY-SA-4.0; SPDX headers swept
- Docs rewritten to describe what exists (the OCaml engine was never
  built); added docs/engine-v0-design.adoc as the normative spec
- Justfile rewritten from OCaml (dune/opam) to cargo; site render helpers
  restored; guix.scm fixed; codemeta/CITATION corrected
- Removed union-policy-parser (preserved in history), corrupted PMPL
  license text, MVP tarballs, badge pack, stale signature files

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JSVSF9HhKUhDrEV4xkMEXq

* ci: fix site build and pre-existing workflow config failures

- site: NimblePublisher evaluates the pre-`---` front-matter block as
  Elixir, so the content files' HTML-comment SPDX header broke the build
  ("unexpected ( after alias Copyright"). Use `#` Elixir comments instead.
- secret-scanner: remove the redundant, unpinned `trufflehog@main` inline
  job (the SHA-pinned secret-scanner-reusable already covers it), fixing
  the governance workflow security linter.
- codeql: analyze `rust` instead of `javascript-typescript` — the repo has
  no JS/TS, which caused a CodeQL configuration error.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JSVSF9HhKUhDrEV4xkMEXq

* fix(site): use @pages module attribute, not undefined pages/0

NimblePublisher's `as: :pages` option populates the `@pages` module
attribute with the parsed Page structs; there is no generated `pages/0`
function. build/0 referenced the nonexistent function.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JSVSF9HhKUhDrEV4xkMEXq

* fix(ci): gate Pages deploy to main and restore id-token permission

The deploy job's permissions block overrode the workflow-level grant and
dropped id-token: write, which actions/deploy-pages needs for OIDC —
causing "Unable to get ACTIONS_ID_TOKEN_REQUEST_URL". It also ran on pull
requests, which would publish unmerged content to the live Pages site.

- gate deploy to push on the default branch (skipped on PRs)
- restore id-token: write on the deploy job
- target the github-pages environment as deploy-pages v5 expects

On PRs the site is now build-verified only; deploy runs on merge to main.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JSVSF9HhKUhDrEV4xkMEXq

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.gitattributes

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # RSR-compliant .gitattributes
 
 * text=auto eol=lf

.github/FUNDING.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Funding platforms for hyperpolymath projects
 # See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository
 

.github/dependabot.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Dependabot configuration for RSR-compliant repositories
 # Covers common ecosystems - remove unused ones for your project
 

.github/workflows/boj-build.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 #
 # OPTIONAL: BoJ Server Build Trigger
 # This workflow notifies a BoJ Server instance when code is pushed.

.github/workflows/codeql.yml

@@ -27,7 +27,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - language: javascript-typescript
+          - language: rust
             build-mode: none
     steps:
       - name: Checkout

.github/workflows/dependabot-automerge.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 #
 # dependabot-automerge.yml — enable GitHub's native auto-merge on
 # Dependabot pull requests that match a declared severity / ecosystem

.github/workflows/dogfood-gate.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # dogfood-gate.yml — Hyperpolymath Dogfooding Quality Gate

.github/workflows/governance.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: Governance
 
 on:

.github/workflows/hypatia-scan.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: Hypatia Security Scan
 
 on:

.github/workflows/instant-sync.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Instant Forge Sync - Triggers propagation to all forges on push/release
 name: Instant Sync
 on: