feat(governance): add rust-ci-reusable + elixir-ci-reusable workflows (#174)

## Why — extends #168 to the next two template-drift bug classes

\`#168\` (merged) consolidated language-policy into governance-reusable
and added deno-ci-reusable. That pattern — single source-of-truth
reusable in standards consumed via a thin wrapper — kills the "every
copy drifts independently" failure mode.

Estate audit done with \`gh api search/code\` (2026-05-26):

| template            | repos | unique SHAs | drift  |
|---------------------|-------|-------------|--------|
| \`rust-ci.yml\`        | **137** | **30**        | high   |
| \`elixir-ci.yml\`      | **9**   | **9**         | 100%   |
| \`rescript-deno-ci.yml\` | 1+    | 2+          | fixed in #168 |

\`elixir-ci.yml\` is especially bad — every copy is unique, and at least
one (\`bofig\`) is YAML-broken with literal \`npermissions:\` lines from
a botched estate sweep.

## What changes

Two new reusable workflows in \`.github/workflows/\`:

### \`rust-ci-reusable.yml\`
- Split jobs: \`check\` (cargo check + fmt + clippy) and \`test\` (cargo
test). \`test\` \`needs: check\`.
- \`if: hashFiles('Cargo.toml')\` guard on every job so the wrapper is
safe to add to non-Rust repos.
- Top-level + per-job \`permissions: contents: read\`.
- Opt-in inputs:
- \`enable_audit\` (default false — \`cargo install cargo-audit\` adds
~3-4 min per run)
  - \`enable_coverage\` (default false — tarpaulin + codecov upload)
- \`clippy_args\` / \`test_args\` / \`check_args\` — per-repo overrides
  - \`runs-on\`

### \`elixir-ci-reusable.yml\`
- Two-cache layers (\`deps\` + \`_build\`), keyed by \`elixir-version\`
+ \`mix.lock\` hash.
- **\`mix deps.compile\`** step BEFORE \`mix compile
--warnings-as-errors\` so transitive-dep warnings (e.g. rustler's
\`:json.decode\` requiring Elixir 1.18, deprecated \`use Bitwise\`)
don't fail the strict gate. Validated against tma-mark2 #41 in commit
\`fa32c4f\`.
- Default \`elixir-version: \"1.17\"\` — the \`1.15\` default in the
legacy template produced the \`(Mix) … declared in its mix.exs file it
supports only Elixir ~> 1.17\` error tma-mark2 #41 lived.
- Opt-in inputs:
  - \`enable_dialyzer\` (default false — slow cold-cache)
  - \`enable_credo\` (default true)
  - \`otp-version\` / \`elixir-version\` overrides
- Guards every job on \`hashFiles('mix.exs')\`.

## Downstream rollout

After merge, each of the 137 (Rust) / 9 (Elixir) repos can replace its
local copy with a 5-line wrapper:

\`\`\`yaml
# .github/workflows/rust-ci.yml
name: Rust CI
on:
  push: { branches: [main, master] }
  pull_request:
permissions:
  contents: read
jobs:
  rust-ci:
uses:
hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@main
\`\`\`

Same shape as \`governance.yml\` → \`governance-reusable.yml\`, and the
absolute-zero #41 + tma-mark2 #41 \`deno-ci.yml\` wrappers landed
yesterday. Rollout can be fanned out per-repo.

## Test plan

- [ ] CI green on this PR (the reusables are workflow_call-only; their
content gets exercised via the next PR that adopts them).
- [ ] After merge, file 1-2 wrapper PRs against repos with known-red
rust-ci CI as smoke tests (e.g., repos in the inbox triage that fail on
\`Workflow security linter\` complaining about missing
\`permissions:\`).
- [ ] Confirm \`enable_audit: true\` works on a repo that opts in.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/elixir-ci-reusable.yml

@@ -43,6 +43,15 @@
 #       with:
 #         elixir-version: "1.18"
 #         enable_dialyzer: true
+#
+# Sub-directory project (mix.exs lives in a subfolder — applies to
+# burble's server/, feedback-o-tron, verisimdb):
+#
+#   jobs:
+#     elixir-ci:
+#       uses: hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@main
+#       with:
+#         working_directory: server
 
 name: Elixir CI (reusable)
 
@@ -74,6 +83,16 @@ on:
         type: boolean
         required: false
         default: true
+      working_directory:
+        description: |
+          Directory containing `mix.exs` (relative to the repo root). All
+          mix invocations and cache lookups consult this directory.
+          Default `.` keeps single-app repos unchanged. Set to e.g.
+          `server` for a sub-app layout (burble, feedback-o-tron,
+          verisimdb at audit time).
+        type: string
+        required: false
+        default: "."
 
 permissions:
   contents: read
@@ -83,11 +102,14 @@ jobs:
     name: Compile + test
     runs-on: ${{ inputs.runs-on }}
     # Guard on mix.exs so the wrapper is safe to add unconditionally.
-    if: hashFiles('mix.exs') != ''
+    if: hashFiles(format('{0}/mix.exs', inputs.working_directory)) != ''
     permissions:
       contents: read
     env:
       MIX_ENV: test
+    defaults:
+      run:
+        working-directory: ${{ inputs.working_directory }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -104,14 +126,14 @@ jobs:
       - name: Cache deps
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
-          path: deps
-          key: deps-${{ inputs.elixir-version }}-${{ hashFiles('mix.lock') }}
+          path: ${{ inputs.working_directory }}/deps
+          key: deps-${{ inputs.elixir-version }}-${{ hashFiles(format('{0}/mix.lock', inputs.working_directory)) }}
 
       - name: Cache _build
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
-          path: _build
-          key: build-${{ inputs.elixir-version }}-${{ hashFiles('mix.lock') }}
+          path: ${{ inputs.working_directory }}/_build
+          key: build-${{ inputs.elixir-version }}-${{ hashFiles(format('{0}/mix.lock', inputs.working_directory)) }}
 
       - name: Install deps
         run: mix deps.get

.github/workflows/rust-ci-reusable.yml

@@ -29,6 +29,25 @@
 #       with:
 #         enable_audit: true
 #         enable_coverage: true
+#
+# Sub-crate / monorepo workspace (Cargo.toml lives in a subdirectory):
+#
+#   jobs:
+#     rust-ci-cli:
+#       uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@main
+#       with:
+#         working_directory: crates/cli
+#     rust-ci-server:
+#       uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@main
+#       with:
+#         working_directory: crates/server
+#
+# Out-of-scope (left bespoke per-repo): multi-OS matrices, cross-compile
+# (`cross build`), multi-Rust-version matrices. Each has too much per-repo
+# variance to share a single abstraction cleanly (verified against the 5
+# matrix-using repos as of 2026-05-26: julia-the-viper / verisimdb /
+# verisimiser / reasonably-good-token-vault use four different matrix
+# dimensions).
 
 name: Rust CI (reusable)
 
@@ -65,6 +84,17 @@ on:
         type: string
         required: false
         default: "--all-targets"
+      working_directory:
+        description: |
+          Directory containing `Cargo.toml` (relative to the repo root). All
+          cargo invocations cd into this directory; `hashFiles()` guards also
+          consult it. Default `.` keeps single-crate repos unchanged. Set
+          to e.g. `crates/server` for a sub-crate, or pass a different
+          value per wrapper call when running the reusable in a workspace
+          via separate jobs.
+        type: string
+        required: false
+        default: "."
 
 permissions:
   contents: read
@@ -76,9 +106,12 @@ jobs:
   check:
     name: Cargo check + clippy + fmt
     runs-on: ${{ inputs.runs-on }}
-    if: hashFiles('Cargo.toml') != ''
+    if: hashFiles(format('{0}/Cargo.toml', inputs.working_directory)) != ''
     permissions:
       contents: read
+    defaults:
+      run:
+        working-directory: ${{ inputs.working_directory }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -93,6 +126,8 @@ jobs:
 
       - name: Cache cargo registry and build
         uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
+        with:
+          workspaces: ${{ inputs.working_directory }}
 
       - name: Cargo check
         run: cargo check ${{ inputs.check_args }}
@@ -107,9 +142,12 @@ jobs:
     name: Cargo test
     runs-on: ${{ inputs.runs-on }}
     needs: check
-    if: hashFiles('Cargo.toml') != ''
+    if: hashFiles(format('{0}/Cargo.toml', inputs.working_directory)) != ''
     permissions:
       contents: read
+    defaults:
+      run:
+        working-directory: ${{ inputs.working_directory }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -122,6 +160,8 @@ jobs:
 
       - name: Cache cargo registry and build
         uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
+        with:
+          workspaces: ${{ inputs.working_directory }}
 
       - name: Run tests
         run: cargo test ${{ inputs.test_args }}
@@ -139,9 +179,12 @@ jobs:
   audit:
     name: Cargo audit (security)
     runs-on: ${{ inputs.runs-on }}
-    if: ${{ inputs.enable_audit && hashFiles('Cargo.toml') != '' }}
+    if: ${{ inputs.enable_audit && hashFiles(format('{0}/Cargo.toml', inputs.working_directory)) != '' }}
     permissions:
       contents: read
+    defaults:
+      run:
+        working-directory: ${{ inputs.working_directory }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -164,9 +207,12 @@ jobs:
   coverage:
     name: Coverage (tarpaulin + codecov)
     runs-on: ${{ inputs.runs-on }}
-    if: ${{ inputs.enable_coverage && hashFiles('Cargo.toml') != '' }}
+    if: ${{ inputs.enable_coverage && hashFiles(format('{0}/Cargo.toml', inputs.working_directory)) != '' }}
     permissions:
       contents: read
+    defaults:
+      run:
+        working-directory: ${{ inputs.working_directory }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2