ci(language-policy): carve out Kotlin/JVM consumer interop from banned-languages gate (#417)

## What

Adds a policy carve-out so legitimate **Kotlin/Groovy JVM interop** is
no longer flagged by the estate banned-languages check — exactly
parallel to the existing TS `bindings/typescript/` / `bindings/deno/`
and `clients/vscode/` carve-outs.

## The gate

The single gate that flags these repos is the `language-policy` job's
`JAVA_FILES` step in `.github/workflows/governance-reusable.yml` (the
governance-reusable that all three repos call via their
`governance.yml`). It globbed `*.java *.kt *.kts` and hard-failed any
match outside the narrow Android-Java carve-out. (Hypatia's
`cicd_rules.ex` has **no** Kotlin/Java rule, so there is no hypatia
carve-out to add — this workflow is the only gate.)

## Affected repos (Kotlin/Groovy interop, NOT mobile app code)

| Repo | Path | Files | Class |
|---|---|---|---|
| `proven-servers` | `bindings/kotlin/**` | ~102 | consumer binding |
| `proven` | `bindings/kotlin/**` + `bindings/groovy/**` | ~5 | consumer
binding |
| `universal-language-server-plugin` | `clients/jetbrains/**` | 1 |
editor-host plugin (IntelliJ Platform API is Kotlin-native) |

Tauri/Dioxus cannot replace a consumer binding or an IDE-host plugin, so
these are exempted, not deleted.

## Change

Three path-exclusion carve-outs added to `JAVA_FILES`:

- `bindings/kotlin/`
- `bindings/groovy/`
- `clients/jetbrains/`

`*.groovy` is added to the `git ls-files` set so the carve-out is
explicit and any future Groovy *outside* these dirs is still caught.
Mobile Kotlin/Swift remains banned (the *Mobile Development* policy is
unchanged). Full rationale + unblock conditions are in the workflow
comment block (the single source of truth).

## Verification

Simulated the post-change `JAVA_FILES` pipeline against each repo's
tracked files: all `.kt`/`.kts`/`.groovy` under the three carve-out dirs
are now excluded. `universal-language-server-plugin` is fully clean on
this check.

> Note: `proven` and `proven-servers` also carry `bindings/java/**` (JNI
wrappers, ~100 / ~22 files) which the pre-existing `*.java` glob flags
independently of this change. That is the same consumer-binding pattern
but was **out of scope** for this task (Kotlin/Groovy/JetBrains only)
and is left for an owner decision rather than silently broadening the
Java ban.

No licence/SPDX headers touched.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/governance-reusable.yml

@@ -200,7 +200,7 @@ jobs:
       #   3. Inline `# hypatia:ignore ...` pragma in the file's first
       #      8 lines — the same escape the Hypatia scanner itself
       #      honours.
-      - name: Check banned-language files (ReScript / Go / Python / Java / Kotlin / Swift / Dart / V-lang / ATS2 / Makefile)
+      - name: Check banned-language files (ReScript / Go / Python / Java / Kotlin / Groovy / Swift / Dart / V-lang / ATS2 / Makefile)
         run: |
           rule_module="cicd_rules"
           rule_type="banned_language_file"
@@ -307,9 +307,31 @@ jobs:
           # name at platform boundaries — Rust/Zig cannot provide JVM
           # bytecode for these. Each Android Java shim must be a minimal
           # delegating wrapper (typically <10 LoC) that JNIs into Rust/Zig
-          # immediately. Kotlin (*.kt, *.kts) remains banned outright.
-          JAVA_FILES=$(git ls-files '*.java' '*.kt' '*.kts' \
-            | grep -vE '(^|/)android/.*/src/.*\.java$' || true)
+          # immediately.
+          #
+          # Kotlin/JVM INTEROP carve-out 2026-06-24 (parallel to the TS
+          # `bindings/typescript/` / `bindings/deno/` / `clients/vscode/`
+          # interop carve-outs): Kotlin/Groovy is banned for MOBILE app code
+          # (→ Tauri/Dioxus), but is PERMITTED as consumer-facing JVM interop
+          # — directories where we author bindings that expose an estate
+          # library to JVM consumers, or an IDE-host plugin whose plugin API
+          # is Kotlin-native. Tauri/Dioxus cannot replace a consumer binding
+          # or an editor-host plugin. Three path classes are exempt:
+          #   * **/bindings/kotlin/**  — Kotlin bindings exposing a library to
+          #     JVM consumers (exemplars: proven-servers, proven).
+          #   * **/bindings/groovy/**  — Groovy bindings, same rationale
+          #     (exemplar: proven).
+          #   * **/clients/jetbrains/** — JetBrains IDE plugin; the IntelliJ
+          #     Platform plugin API is Kotlin-native (exemplar:
+          #     universal-language-server-plugin).
+          # Unblock condition: never (consumer binding / editor-host plugin).
+          # `.groovy` is included in the ls-files set ONLY so the carve-out is
+          # explicit and future Groovy bindings outside these dirs are caught.
+          JAVA_FILES=$(git ls-files '*.java' '*.kt' '*.kts' '*.groovy' \
+            | grep -vE '(^|/)android/.*/src/.*\.java$' \
+            | grep -vE '(^|/)bindings/kotlin/' \
+            | grep -vE '(^|/)bindings/groovy/' \
+            | grep -vE '(^|/)clients/jetbrains/' || true)
           SWIFT_FILES=$(git ls-files '*.swift' || true)
           DART_FILES=$(git ls-files '*.dart' 'pubspec.yaml' || true)
           # V-lang detected by manifest (v.mod / vpkg.json); the .v extension
@@ -322,7 +344,7 @@ jobs:
           enforce "Go files" "use Rust/WASM instead" "$GO_FILES"
           enforce "Python files" "Python is fully banned — use AffineScript/Rust/SPARK/Julia (SaltStack carveout removed 2026-01-03)" "$PY_FILES"
           enforce "Makefiles" "use Mustfile/justfile instead" "$MAKE_FILES"
-          enforce "Java/Kotlin files" "use Rust/Tauri/Dioxus instead" "$JAVA_FILES"
+          enforce "Java/Kotlin/Groovy files" "use Rust/Tauri/Dioxus instead (consumer JVM interop is exempt under bindings/kotlin, bindings/groovy, clients/jetbrains)" "$JAVA_FILES"
           enforce "Swift files" "use Tauri/Dioxus instead" "$SWIFT_FILES"
           enforce "Flutter/Dart files" "use Tauri/Dioxus instead (Google lock-in)" "$DART_FILES"
           enforce "V-lang manifests (v.mod / vpkg.json)" "V-lang is banned since 2026-04-10 — migrate to Zig" "$VMOD_FILES"