feat: implement site security structure enforcement and scaffolding (Issue #11)

Author: hyperpolymath

contractiles/trust/Trustfile.a2ml

@@ -23,3 +23,20 @@ Maximal trust by default — LLM may read, build, test, lint, format.
 - description: No .env or credential files in repo
 - run: test ! -f .env && test ! -f credentials.json && test ! -f .env.local
 - severity: critical
+
+## Website Security
+
+#### site-security-headers
+- description: Any website directory (www, site, docs/site) must contain a security_headers directory
+- run: "for d in www site docs/site; do if [ -d \"$d\" ]; then test -d \"$d/security_headers\" || exit 1; fi; done"
+- severity: critical
+
+#### site-well-known
+- description: Any website directory must contain a .well-known directory
+- run: "for d in www site docs/site; do if [ -d \"$d\" ]; then test -d \"$d/.well-known\" || exit 1; fi; done"
+- severity: warning
+
+#### site-resource-records
+- description: Any website directory must contain a resource_records directory
+- run: "for d in www site docs/site; do if [ -d \"$d\" ]; then test -d \"$d/resource_records\" || exit 1; fi; done"
+- severity: warning