ci: prune to brand-surface workflow set + clear inherited template debt

These repos are brand surfaces (docs + a face shim); the full-parity mirror
brought rattlescript's compiler-grade CI and unfilled rsr-template debt, which
cannot pass on a no-build repo. Prune .github/workflows to governance +
hypatia-scan (the brand-surface set the stubs had); remove the misplaced root
.machine_readable a2ml dupes (canonical copies live in 6a2/); fix
src/abi -> src/interface/Abi doc drift; replace the placeholder SECURITY.md
with real brand-surface content; drop commented example creds in .envrc
(Hypatia false positive).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KPG9mEQXFyA3k7NWAzMNMr

Author: claude

.envrc

@@ -20,8 +20,6 @@ fi
 # Project environment variables
 export PROJECT_NAME="{{PROJECT_NAME}}"
 export RSR_TIER="infrastructure"
-# export DATABASE_URL="..."
-# export API_KEY="..."
 
 # Source .env if it exists (gitignored)
 dotenv_if_exists