ci(language-policy): drop SaltStack Python carveout (closes reposystem#32)

Discharges hyperpolymath/reposystem#32. The SaltStack Python exception was
removed estate-wide on 2026-01-03 (canonical .claude/CLAUDE.md already
reflects this), but five workflow files still encoded the legacy carveout:

- .github/workflows/governance-reusable.yml — the RSR antipattern check
  (`grep -v salt | grep -v _states | grep -v _modules | grep -v pillar`)
  + the "only allowed for SaltStack" enforce-message + the trailing
  "SaltStack (Python)" line in the summary banner.
- 4× language-policy.yml (rhodium-standard-repositories root,
  consent-aware-http, +2 satellites) — the `| grep -v 'salt'` filter
  on new .py files and the "(except SaltStack)" comment.

Infrastructure moved to Terraform + Ansible; neither needs first-party
Python so no replacement exemption is required.

Closes hyperpolymath/reposystem#32

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/governance-reusable.yml

@@ -312,9 +312,7 @@ jobs:
           RES_FILES=$(git ls-files '*.res' || true)
           GO_FILES=$(git ls-files '*.go' || true)
           PY_FILES=$(git ls-files '*.py' \
-            | grep -v salt | grep -v _states \
-            | grep -v _modules | grep -v pillar | grep -v venv \
-            | grep -v __pycache__ || true)
+            | grep -v venv | grep -v __pycache__ || true)
           MAKE_FILES=$(git ls-files 'Makefile' 'Makefile.*' '*.mk' \
             | grep -v '\.github/' || true)
           JAVA_FILES=$(git ls-files '*.java' '*.kt' '*.kts' || true)
@@ -328,7 +326,7 @@ jobs:
 
           enforce "ReScript files" "use AffineScript instead" "$RES_FILES"
           enforce "Go files" "use Rust/WASM instead" "$GO_FILES"
-          enforce "Python files" "only allowed for SaltStack" "$PY_FILES"
+          enforce "Python files" "Python is fully banned — use AffineScript/Rust/SPARK/Julia (SaltStack carveout removed 2026-01-03)" "$PY_FILES"
           enforce "Makefiles" "use Mustfile/justfile instead" "$MAKE_FILES"
           enforce "Java/Kotlin files" "use Rust/Tauri/Dioxus instead" "$JAVA_FILES"
           enforce "Swift files" "use Tauri/Dioxus instead" "$SWIFT_FILES"
@@ -430,7 +428,7 @@ jobs:
       - name: Summary
         run: |
           echo "RSR language/package policy passed — allowed: AffineScript, Deno,"
-          echo "WASM, Rust, OCaml, Haskell, Guile/Scheme, SaltStack (Python)."
+          echo "WASM, Rust, OCaml, Haskell, Guile/Scheme."
 
   package-policy:
     name: Guix primary / Nix fallback policy

consent-aware-http/.github/workflows/language-policy.yml

@@ -8,8 +8,8 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - name: Enforce language policies
         run: |
-          # Block new Python files (except SaltStack)
-          NEW_PY=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.py$' | grep -v 'salt' || true)
+          # Block new Python files (Python fully banned 2026-01-03 — SaltStack carveout removed)
+          NEW_PY=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.py$' || true)
           if [ -n "$NEW_PY" ]; then
             echo "❌ New Python files detected. Use Rust or AffineScript instead."
             echo "$NEW_PY"

rhodium-standard-repositories/.github/workflows/language-policy.yml

@@ -11,8 +11,8 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - name: Enforce language policies
         run: |
-          # Block new Python files (except SaltStack)
-          NEW_PY=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.py$' | grep -v 'salt' || true)
+          # Block new Python files (Python fully banned 2026-01-03 — SaltStack carveout removed)
+          NEW_PY=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.py$' || true)
           if [ -n "$NEW_PY" ]; then
             echo "❌ New Python files detected. Use Rust or AffineScript instead."
             echo "$NEW_PY"

rhodium-standard-repositories/satellites/consent-aware-http/.github/workflows/language-policy.yml

@@ -7,8 +7,8 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - name: Enforce language policies
         run: |
-          # Block new Python files (except SaltStack)
-          NEW_PY=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.py$' | grep -v 'salt' || true)
+          # Block new Python files (Python fully banned 2026-01-03 — SaltStack carveout removed)
+          NEW_PY=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.py$' || true)
           if [ -n "$NEW_PY" ]; then
             echo "❌ New Python files detected. Use Rust or AffineScript instead."
             echo "$NEW_PY"

rhodium-standard-repositories/satellites/palimpsest-license/.github/workflows/language-policy.yml

@@ -7,8 +7,8 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: Enforce language policies
         run: |
-          # Block new Python files (except SaltStack)
-          NEW_PY=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.py$' | grep -v 'salt' || true)
+          # Block new Python files (Python fully banned 2026-01-03 — SaltStack carveout removed)
+          NEW_PY=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.py$' || true)
           if [ -n "$NEW_PY" ]; then
             echo "❌ New Python files detected. Use Rust or AffineScript instead."
             echo "$NEW_PY"