feat(bot-policy): add bot_exclusion_registry.a2ml — estate-wide denylist

Prevents the "bot tries to refactor upstream Rust toolchain" embarrassment
scenario via three independent axes — a match on ANY axis blocks the action:

  1. external-repos — 6 confirmed collaborator/org-member repos (JoshuaJewell
     son-namespace, The-Metadatastician, Campus-Advisors). Scan-only.

  2. vendored-directory-patterns — 20 globs: deps/**, vendor/**, third_party/**,
     toolchain/**, rustlib/**, rust-src/**, .rustup/**, .cargo/**, node_modules/**,
     _build/**, target/**, winget-pkgs/**, macports-ports/**, compiler-source/**,
     HOL/**, .hex/**, .mypy_cache/** — catches vendored copies regardless of
     which repo they appear in.

  3. remote-origin-patterns — 17 full-denial patterns: github.com/rust-lang/*,
     Homebrew/*, NixOS/*, llvm/*, ocaml/*, elixir-lang/*, erlang/*, golang/*,
     python/*, haskell/*, ziglang/*, JuliaLang/*, idris-lang/*, coq/*,
     leanprover/*, agda/*. Catches the case where user locally clones an
     upstream repo outside the hyperpolymath tree.

Candidates section (18 hyperpolymath-owned repos with Dependabot disabled —
signature of upstream forks: awesome-*, file, linguist, rescript, servers,
lua-filters, info) listed as `awaiting-user-confirmation`, NOT enforced.
Proposed stance: scan-only. User to confirm before promotion.

Enforcement: single-point in robot-repo-automaton/src/confidence.rs, belt-and-
braces in each Tier-1/Tier-2 bot (so comments are gated too). Fail-closed —
if the registry can't be loaded, all bots refuse to write. Kill-switch env
HYPATIA_AUTOMATION halts everything instantly.

Default stance for unknown repos remains allow (330 owned repos; default-deny
would be too aggressive). Per-axis decisions are specific, not default.

This file is the authoritative registry. Bot implementations will be updated
in a follow-up PR wave to actually load and honour it.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath