ci(language-policy): drop SaltStack Python carveout (closes reposystem#32) (#316)

## Summary
- Removes the SaltStack Python exception from `governance-reusable.yml`
(RSR antipattern check + summary banner) and 4× `language-policy.yml`
(rhodium-standard-repositories root, consent-aware-http, +2 satellites).
- Estate-wide rule: Python is fully banned, no exceptions (removed
2026-01-03; canonical `.claude/CLAUDE.md` already reflects this).
- Infrastructure now uses Terraform + Ansible — neither needs
first-party Python, so no replacement exemption.

## Test plan
- [ ] Existing repos with no \`.py\` files: language policy still passes
(no behavioural change).
- [ ] A hypothetical new \`*.py\` file (regardless of
\`salt\`/\`_states\`/\`_modules\`/\`pillar\` in path) is now blocked.
- [ ] Estate-wide reusable callers (governance-reusable consumers) pick
up the corrected enforce-message.

## Closes
- hyperpolymath/reposystem#32

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/governance-reusable.yml

@@ -312,9 +312,7 @@ jobs:
           RES_FILES=$(git ls-files '*.res' || true)
           GO_FILES=$(git ls-files '*.go' || true)
           PY_FILES=$(git ls-files '*.py' \
-            | grep -v salt | grep -v _states \
-            | grep -v _modules | grep -v pillar | grep -v venv \
-            | grep -v __pycache__ || true)
+            | grep -v venv | grep -v __pycache__ || true)
           MAKE_FILES=$(git ls-files 'Makefile' 'Makefile.*' '*.mk' \
             | grep -v '\.github/' || true)
           JAVA_FILES=$(git ls-files '*.java' '*.kt' '*.kts' || true)
@@ -328,7 +326,7 @@ jobs:
 
           enforce "ReScript files" "use AffineScript instead" "$RES_FILES"
           enforce "Go files" "use Rust/WASM instead" "$GO_FILES"
-          enforce "Python files" "only allowed for SaltStack" "$PY_FILES"
+          enforce "Python files" "Python is fully banned — use AffineScript/Rust/SPARK/Julia (SaltStack carveout removed 2026-01-03)" "$PY_FILES"
           enforce "Makefiles" "use Mustfile/justfile instead" "$MAKE_FILES"
           enforce "Java/Kotlin files" "use Rust/Tauri/Dioxus instead" "$JAVA_FILES"
           enforce "Swift files" "use Tauri/Dioxus instead" "$SWIFT_FILES"
@@ -430,7 +428,7 @@ jobs:
       - name: Summary
         run: |
           echo "RSR language/package policy passed — allowed: AffineScript, Deno,"
-          echo "WASM, Rust, OCaml, Haskell, Guile/Scheme, SaltStack (Python)."
+          echo "WASM, Rust, OCaml, Haskell, Guile/Scheme."
 
   package-policy:
     name: Guix primary / Nix fallback policy

consent-aware-http/.github/workflows/language-policy.yml

@@ -8,8 +8,8 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - name: Enforce language policies
         run: |
-          # Block new Python files (except SaltStack)
-          NEW_PY=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.py$' | grep -v 'salt' || true)
+          # Block new Python files (Python fully banned 2026-01-03 — SaltStack carveout removed)
+          NEW_PY=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.py$' || true)
           if [ -n "$NEW_PY" ]; then
             echo "❌ New Python files detected. Use Rust or AffineScript instead."
             echo "$NEW_PY"

rhodium-standard-repositories/.github/workflows/language-policy.yml

@@ -11,8 +11,8 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - name: Enforce language policies
         run: |
-          # Block new Python files (except SaltStack)
-          NEW_PY=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.py$' | grep -v 'salt' || true)
+          # Block new Python files (Python fully banned 2026-01-03 — SaltStack carveout removed)
+          NEW_PY=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.py$' || true)
           if [ -n "$NEW_PY" ]; then
             echo "❌ New Python files detected. Use Rust or AffineScript instead."
             echo "$NEW_PY"

rhodium-standard-repositories/satellites/consent-aware-http/.github/workflows/language-policy.yml

@@ -7,8 +7,8 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - name: Enforce language policies
         run: |
-          # Block new Python files (except SaltStack)
-          NEW_PY=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.py$' | grep -v 'salt' || true)
+          # Block new Python files (Python fully banned 2026-01-03 — SaltStack carveout removed)
+          NEW_PY=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.py$' || true)
           if [ -n "$NEW_PY" ]; then
             echo "❌ New Python files detected. Use Rust or AffineScript instead."
             echo "$NEW_PY"

rhodium-standard-repositories/satellites/palimpsest-license/.github/workflows/language-policy.yml

@@ -7,8 +7,8 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: Enforce language policies
         run: |
-          # Block new Python files (except SaltStack)
-          NEW_PY=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.py$' | grep -v 'salt' || true)
+          # Block new Python files (Python fully banned 2026-01-03 — SaltStack carveout removed)
+          NEW_PY=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.py$' || true)
           if [ -n "$NEW_PY" ]; then
             echo "❌ New Python files detected. Use Rust or AffineScript instead."
             echo "$NEW_PY"