chore(trust): annotate Trustfile.a2ml template placeholders with TEMPLATE NOTE comments

All seven {{...}} placeholders that are intentionally per-repo
(LAST_PROOF_CHECK_DATE, PROVEN_HASH, COST_CEILING_POLICY, SECURITY_CONTACT,
DOMAIN, SECURITY_TXT_EXPIRES, THIS_REPO/REPO_SOPS_ADOPTION_STATUS,
RGTV_ENABLED_FOR_REPO) now have a # TEMPLATE NOTE comment above them
explaining what shape the concrete value takes and how to derive it.
Placeholders themselves are unchanged — they remain as deployment targets.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.machine_readable/contractiles/trust/Trustfile.a2ml

@@ -370,6 +370,9 @@ at_rest:
   per_repo_adoption:
     - repo: "lcb-website"
       status: "DEPLOYED"
+    # TEMPLATE NOTE: replace {{THIS_REPO}} with the repo name (e.g. "boj-server") and
+    # {{REPO_SOPS_ADOPTION_STATUS}} with one of: "DEPLOYED", "PENDING — runtime-only via Rokur,
+    # no at-rest secrets in this repo", or a concise description of the actual status.
     - repo: "{{THIS_REPO}}"
       status: "{{REPO_SOPS_ADOPTION_STATUS}}"
   pre_commit_hooks:
@@ -391,6 +394,9 @@ llm_agents:
   tool: "RGTV"
   status: "ALPHA — NOT production-ready, see RGTV/README.adoc known-unsafe list"
   scope: "LLM-agent credential brokering only — opaque one-use grants"
+  # TEMPLATE NOTE: replace {{RGTV_ENABLED_FOR_REPO}} with "true" if this repo brokers
+  # LLM-agent credentials via RGTV, or "false — <reason>" if not. Most repos will be false.
+  # RGTV is ALPHA; see RGTV/README.adoc for the known-unsafe list.
   enabled_here: "{{RGTV_ENABLED_FOR_REPO}}"
 security:
   proof: "Secrets.Hygiene.idr"
@@ -503,6 +509,8 @@ theorems:
 compiler:
   idris2_version: "0.8.0"
   zig_version: "0.15.2"
+  # TEMPLATE NOTE: replace {{LAST_PROOF_CHECK_DATE}} with the ISO-8601 date of the last
+  # Idris2 proof rebuild in this repo (e.g. "2026-04-17"). Updated at each proof-rebuild session.
   last_check: "{{LAST_PROOF_CHECK_DATE}}"
 axioms:
   declared: []
@@ -558,6 +566,8 @@ policy: |
   Responsible disclosure welcomed. Researchers reporting real vulnerabilities
   in good faith receive acknowledgement in SECURITY.adoc and in
   /.well-known/security-acknowledgments. See security.txt for contact path.
+# TEMPLATE NOTE: replace {{SECURITY_CONTACT}} with a mailto: URI for this repo's
+# security contact, e.g. "mailto:j.d.a.jewell@open.ac.uk".
 contact: "{{SECURITY_CONTACT}}"
 recognition:
   mechanism: "security-acknowledgments list"
@@ -768,7 +778,12 @@ security_txt:
   enabled: true
   contact: "mailto:j.d.a.jewell@open.ac.uk"
   preferred_languages: "en"
+  # TEMPLATE NOTE: replace {{SECURITY_TXT_EXPIRES}} with an RFC 3339 datetime 1 year from deployment,
+  # e.g. "2027-04-17T00:00:00Z". Auto-renewed by CI.
   expires: "{{SECURITY_TXT_EXPIRES}}"
+  # TEMPLATE NOTE: replace {{DOMAIN}} with the canonical domain for this repo (bare domain or
+  # GitHub Pages URL), e.g. "boj-server.hyperpolymath.dev" or "github.com/hyperpolymath/<repo>".
+  # Used in all /.well-known/ paths below.
   policy: "https://{{DOMAIN}}/.well-known/security-policy"
   acknowledgments: "https://{{DOMAIN}}/.well-known/security-acknowledgments"
   encryption: "https://{{DOMAIN}}/.well-known/pgp-key.txt"
@@ -805,6 +820,9 @@ rate_limiting:
     - "shadow-ban for persistent offenders"
   cost_ceiling:
     policy: "operator-managed emergency brake above tier 1"
+    # TEMPLATE NOTE: replace {{COST_CEILING_POLICY}} with a concise operator policy string,
+    # e.g. "operator-managed; emergency brake above edge-tier rate limits; specific cap TBD".
+    # This is an operator-choice field — no universal default.
     note: "{{COST_CEILING_POLICY}}"
   security:
     proof: "RateLimiting.Policy.idr"
@@ -1060,6 +1078,10 @@ idris2:
   mechanism: ".ipkg with dep version pinning"
   adoption_status: "PENDING — estate-wide pinning in CRG contractile"
 proven_library:
+  # TEMPLATE NOTE: replace {{PROVEN_HASH}} with the SHA-256 hex digest of
+  # verification-ecosystem/proven/ffi/zig/zig-out/lib/libproven_ffi.a obtained via
+  # `sha256sum .../libproven_ffi.a`. Set to "PENDING" with a note if the lib has not
+  # yet been built for this repo.
   hash_attestation: "{{PROVEN_HASH}}"
   source: "verification-ecosystem/proven"
   verification: "libproven_ffi.a rebuilt on source change; downstream relink verified"