chore(governance): land missing docs/packaging before the standards#505 gates bite (#17)

Remediates this repo against the two governance gates promoted from
advisory to blocking in
[hyperpolymath/standards#513](hyperpolymath/standards#513)
(closing standards#505).

Those gates previously **could not fail**: the docs check only emitted
`::warning::`, and the package-policy job ended in an unconditional `✅
Package policy check passed`. They are now real, with a grace window —
they begin **blocking on 2026-08-21**. This repo was measured as
non-compliant, so this PR lands the missing files ahead of that date.

**Added here:** `CONTRIBUTING + packaging`

### `flake.nix`
A **dev shell**, not a package build. Estate policy is Guix primary /
Nix fallback; this is the fallback tier, and a `guix.scm` is welcome
later to move to the primary.

- Packages mirror the tooling **actually present in this repo** (`none
detected`), not a generic default.
- `nixpkgs` is pinned to an exact revision per the estate SHA-pinning
rule.
- **Verified**: `nix flake check` passes (nix 2.35.1). Every package
name was confirmed to exist in the pinned revision before generation —
nothing here is guessed.

### `CONTRIBUTING.md`
Markdown by estate rule (it is on the GitHub-required community-health
list, unlike `README.adoc`). Content is derived from this repo, not
boilerplate: the build section lists **only `just` recipes that actually
exist here**, and the A2ML section appears only if `.machine_readable/`
is present.

---
Part of an estate-wide sweep; 63 repos were identified as non-compliant.
Third-party/forked repos (`HOL`, `awesome-*`, `lua-filters`) were
**excluded** per the licence policy's do-not-touch rule.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Author: hyperpolymath

CONTRIBUTING.md

@@ -0,0 +1,50 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
+<!-- SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell -->
+
+# Contributing to technical-notes
+
+Thanks for your interest. This repository follows the Hyperpolymath estate
+standards defined in [hyperpolymath/standards](https://github.com/hyperpolymath/standards).
+
+## Licence
+
+This project is licensed under **MPL-2.0**. By contributing you agree that
+your contributions are licensed under the same terms. Every source file
+carries an `SPDX-License-Identifier` header; keep it when editing, and add
+one to any new file.
+
+## Development environment
+
+A pinned dev shell is provided:
+
+```sh
+nix develop        # toolchain: git
+```
+
+Estate policy is Guix primary / Nix fallback; this repo currently ships the
+Nix fallback. A `guix.scm` is welcome if you prefer the primary tier.
+
+## Language policy
+
+The estate restricts which languages may be used. In particular Python, Go,
+TypeScript, ReScript, V-lang, Java/Kotlin, Swift and Makefiles are **not**
+accepted in new code; AffineScript, Rust/SPARK, Zig, Deno, Gleam, Elixir,
+Haskell, Idris2, Agda, Julia and OCaml are. CI enforces this, so check the
+policy in `hyperpolymath/standards` before introducing a new language.
+
+## Documentation format
+
+Docs are AsciiDoc (`.adoc`) by default, including `README.adoc`. The
+GitHub-required community-health files stay Markdown: `SECURITY.md`,
+`CONTRIBUTING.md`, `CODE_OF_CONDUCT.md`, `CHANGELOG.md`. Do not add a `.md`
+duplicate of a doc that already exists as `.adoc`.
+
+## Pull requests
+
+1. Branch from `main` — do not push to `main` directly; branch protection
+   requires review and passing checks.
+2. Keep the change focused, and explain *why* in the PR body.
+3. Make sure governance CI is green. It checks documentation presence,
+   packaging policy, secrets, licence consistency and workflow security.
+4. Security issues: follow `SECURITY.md` — report privately, never in a
+   public issue.

flake.nix

@@ -0,0 +1,34 @@
+# SPDX-License-Identifier: MPL-2.0
+# SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell
+#
+# Development environment for technical-notes.
+#
+# Estate policy is Guix primary / Nix fallback (hyperpolymath/standards).
+# This is the Nix fallback tier. It is a dev shell, not a package build:
+# it declares the toolchain needed to work on this repo, pinned to an
+# exact nixpkgs revision per the estate SHA-pinning rule.
+#
+# No build toolchain was detected in this repository, so the shell
+# carries only git. Add packages here as the repo grows one.
+#
+#   nix develop      # enter the shell
+#   nix flake check  # verify this file evaluates (run before committing)
+{
+  description = "technical-notes development environment";
+
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/b134951a4c9f3c995fd7be05f3243f8ecd65d798";
+
+  outputs = { self, nixpkgs }:
+    let
+      systems = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
+      forAllSystems = f:
+        nixpkgs.lib.genAttrs systems (system: f nixpkgs.legacyPackages.${system});
+    in
+    {
+      devShells = forAllSystems (pkgs: {
+        default = pkgs.mkShell {
+          packages = with pkgs; [ git ];
+        };
+      });
+    };
+}