feat(scripts): AffineScript port of check-ts-allowlist (STEP 2 seed, Refs #239) (#283)

## Summary

AffineScript port of `scripts/check-ts-allowlist.ts` — the meta-tool
that enforces the no-new-TypeScript estate policy. Self-referential:
this script is itself one of the `.ts` files its policy applies to.
Symbolic landing.

Filed under the estate TS→AffineScript migration campaign:
- Umbrella: #239
- Step: #241 (STEP 2 — tail-batch-1)
- Unblocked by: hyperpolymath/affinescript#445 (Deno scripting externs —
walk/args/exit/iso/regex/stderr)

## Pattern

Adapted from phronesis#19 seed: adds `.affine` alongside the live `.ts`;
CI keeps invoking the `.ts`. The follow-up PR can wire
`.github/workflows/governance-reusable.yml` to the compiled `.deno.js`
directly (no `.mjs` wrapper needed — `main()` now calls `Deno.exit()`
itself, matching the TS original).

## Behaviour

Faithful mirror of the TS:

- Built-in directory + filename allowlist (`DIR_NAMES_ALLOWED`,
`*.d.ts`, `mod.ts`, `lsp*.ts`, `*-lsp.ts`, `*.bench.ts`, `*_bench.ts`,
segments containing `vscode` or starting with `deno-`)
- **Layer 2** — `.claude/CLAUDE.md` TypeScript-exemption table parser
(heading regex matches `TypeScript|JavaScript|TS|JS|.tsx?`
`[Ee]xemption`, multi-table aware)
- **Layer 2.5** — `.governance-allowlist` plain-text glob list
- Glob→regex translation (`*` → `.*`, `?` → `.`, regex-escape chars)
- Exempt fallback: regex match, then literal `bare` equality, then
trailing-slash prefix match
- Lex-sort of the violation list (manual `str_lt` via `char_to_int` —
AffineScript has no `<` on String)
- Same exit code (0 success / 1 violation via `Deno.exit`) and same
output text

## Drive-by

SPDX header normalised to `MPL-2.0` (per estate language-policy
2026-05-25; `PMPL-1.0-or-later` on the live `.ts` is the legacy form
pending its own cleanup).

## Test plan

- [x] `affinescript compile scripts/check-ts-allowlist.affine -o
/tmp/check-ts-allowlist.deno.js --deno-esm` → exit 0, clean compile
(oracle per campaign prompt)
- [ ] Build-chain integration (workflow switch from `.ts` to compiled
`.deno.js`) — deferred to follow-up PR per seed pattern

## Notes

Branch was started by a parallel Claude session (479L draft); this PR
added `str_lt` byte-wise lex compare (TS used `<` on String which
AffineScript doesn't overload), SPDX header drive-by, and the
exit()-direct refactor so no `.mjs` wrapper is needed.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Author: hyperpolymath