feat(rsr): add .well-known/{security,ai,humans}.txt + Justfile validate recipe

Real RSR-compliance gaps (genuinely missing artifacts), additive:
- .well-known/security.txt — RFC 9116 (Contact/Expires/Preferred-Languages),
  pointing at the GitHub Security Advisory channel + SECURITY.md.
- .well-known/ai.txt — AI usage/training policy (summary of the estate's
  bot-exclusion registry + 0-ai-gatekeeper-protocol).
- .well-known/humans.txt — humanstxt.org attribution.
- Justfile: a `validate` recipe (registry-check hard dep + RSR self-audit),
  which the RSR standard expects.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019awZjBD1qx61tvmEuEKNpn

Author: claude

.well-known/ai.txt

@@ -0,0 +1,19 @@
+# SPDX-License-Identifier: MPL-2.0
+# AI usage & training policy for hyperpolymath/standards.
+# Informal, robots-style directives for AI/ML agents and crawlers.
+# The estate maintains a machine-readable bot-exclusion registry at
+# .machine_readable/bot_exclusion_registry.a2ml and an AI-gatekeeper
+# protocol under 0-ai-gatekeeper-protocol/; this file is the summary.
+
+User-Agent: *
+
+# Training: do not use this repository's content to train models without
+# attribution under the repository licence.
+Disallow-Training: /
+
+# Reference/indexing for search and developer assistance is permitted,
+# provided attribution and licence terms (see LICENSE, humans.txt) are kept.
+Allow: /
+
+Contact: https://github.com/hyperpolymath/standards/security/advisories/new
+Policy: https://github.com/hyperpolymath/standards/blob/main/.claude/CLAUDE.md

.well-known/humans.txt

@@ -0,0 +1,15 @@
+# SPDX-License-Identifier: MPL-2.0
+# humanstxt.org — the humans responsible for this repository.
+
+/* TEAM */
+  Maintainer: Jonathan D.A. Jewell
+  Contact: 6759885+hyperpolymath [at] users.noreply.github.com
+  Site: https://github.com/hyperpolymath
+
+/* SITE */
+  Standard: Rhodium Standard Repository (RSR) framework + estate standards
+  Components: A2ML, K9, contractiles, readiness grades (ARG/FRG/CRG/TRG),
+              protocols (avow, axel, overlay, consent-aware-http, k9-coordination)
+  Build/tooling: Nix, Guix, Deno, just (Justfile)
+  Licence: MPL-2.0 (sole-owner estate default) — see LICENSE
+  Standards: RFC 9116 (security.txt), Schema.org, IndieWeb (webmention)

.well-known/security.txt

@@ -0,0 +1,9 @@
+# SPDX-License-Identifier: MPL-2.0
+# Security contact information for hyperpolymath/standards (RFC 9116).
+# Full policy: ../SECURITY.md
+Contact: https://github.com/hyperpolymath/standards/security/advisories/new
+Contact: mailto:6759885+hyperpolymath@users.noreply.github.com
+Expires: 2027-06-18T00:00:00.000Z
+Preferred-Languages: en
+Canonical: https://github.com/hyperpolymath/standards/blob/main/.well-known/security.txt
+Policy: https://github.com/hyperpolymath/standards/blob/main/SECURITY.md

Justfile

@@ -24,6 +24,12 @@ topology: registry
 registry-check:
     @bash scripts/build-registry.sh --check
 
+# Aggregate compliance gate: registry drift (hard dep) + RSR self-audit (informational)
+validate: registry-check
+    @echo "=== validate: RSR compliance gate ==="
+    @bash rhodium-standard-repositories/rsr-audit.sh . text || true
+    @echo "=== validate: done (see rsr-audit output above) ==="
+
 # Print role-appropriate LLM warm-up context (machine front door)
 llm-context role="dev":
     @echo "# Front door: 0-AI-MANIFEST.a2ml (machine) + README.adoc (human)"