chore: estate standardization remainder — contractiles restructure, nix removal, Guix manifests, TruffleHog (#151)

Originally the Q5 propositional Equiv migration branch; the proof work
landed on main via #152, and the CI hardening was superseded by
#153–#155. After merging main back in, what remains is the
estate-standardization payload:

- **Contractiles restructure**: old `.machine_readable/*.contractile` +
top-level `contractiles/` tree → `.machine_readable/contractiles/`
(`Mustfile/Trustfile/Adjustfile/Intentfile.a2ml` + Justfile), per the
descriptiles/contractiles naming mandate. Note: the new flat set drops
Dust/Bust files that existed in the old tree — flagging for owner
awareness.
- **Nix removal**: `flake.nix` + `flake.lock` deleted (estate nix-ban);
`guix.scm` remains, plus new per-impl `manifest.scm` + `Justfile` for
elixir/ocaml/coq.
- **TruffleHog secret-scan job** added to secret-scanner.yml (now
SHA-pinned).
- Dotfile cleanup (.gitignore/.gitattributes/.editorconfig reorg),
template-dir (`alkahest-shell-transmuter/`) workflow tidy-up.

Conflict resolution note: main won all 16 conflicted root workflows (its
#153–#155 hardening is newer and this branch's workflow edits were
cosmetic, superseded, or invalid). Post-merge repairs on the branch
payload: removed invalid root-level `timeout-minutes` keys
(startup_failure class), SHA-pinned the TruffleHog jobs (were
`@main`/`@v4`).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Mistral Vibe <vibe@mistral.ai>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: 3 people

.editorconfig

@@ -3,29 +3,31 @@
 
 root = true
 
+# ============
+# Default
+# ============
 [*]
 charset = utf-8
 end_of_line = lf
-indent_size = 2
 indent_style = space
 insert_final_newline = true
 trim_trailing_whitespace = true
 
+# ============
+# Documentation (preserve trailing whitespace)
+# ============
 [*.md]
 trim_trailing_whitespace = false
 
 [*.adoc]
 trim_trailing_whitespace = false
 
+# ============
+# Language-Specific: 4-space indent
+# ============
 [*.rs]
 indent_size = 4
 
-[*.ex]
-indent_size = 2
-
-[*.exs]
-indent_size = 2
-
 [*.zig]
 indent_size = 4
 
@@ -38,6 +40,21 @@ indent_size = 3
 [*.ads]
 indent_size = 3
 
+[Justfile]
+indent_size = 4
+
+[justfile]
+indent_size = 4
+
+# ============
+# Language-Specific: 2-space indent
+# ============
+[*.ex]
+indent_size = 2
+
+[*.exs]
+indent_size = 2
+
 [*.hs]
 indent_size = 2
 
@@ -58,11 +75,3 @@ indent_size = 2
 
 [*.nix]
 indent_size = 2
-
-[Justfile]
-indent_style = space
-indent_size = 4
-
-[justfile]
-indent_style = space
-indent_size = 4

.gitattributes

@@ -1,54 +1,91 @@
 # SPDX-License-Identifier: MPL-2.0
 # RSR-compliant .gitattributes
 
+# ============
+# Default
+# ============
 * text=auto eol=lf
 
-# Source
-*.rs    text eol=lf diff=rust
-*.ex    text eol=lf diff=elixir
-*.exs   text eol=lf diff=elixir
-*.jl    text eol=lf
-*.res   text eol=lf
-*.resi  text eol=lf
-*.ada   text eol=lf diff=ada
-*.adb   text eol=lf diff=ada
-*.ads   text eol=lf diff=ada
-*.hs    text eol=lf
-*.chpl  text eol=lf
-*.scm   text eol=lf
-*.ncl   text eol=lf
-*.nix   text eol=lf
-
-# Docs
-*.md    text eol=lf diff=markdown
-*.adoc  text eol=lf
-*.txt   text eol=lf
-
-# Data
-*.json  text eol=lf
-*.yaml  text eol=lf
-*.yml   text eol=lf
-*.toml  text eol=lf
-
-# Config
-.gitignore     text eol=lf
+# ============
+# Binary Files
+# ============
+*.png binary
+*.jpg binary
+*.gif binary
+*.pdf binary
+*.woff2 binary
+*.zip binary
+*.gz binary
+*.so binary
+*.dylib binary
+*.o binary
+
+# ============
+# Source Code
+# ============
+
+# Rust
+*.rs text eol=lf diff=rust
+
+# Elixir
+*.ex text eol=lf diff=elixir
+*.exs text eol=lf diff=elixir
+
+# Julia
+*.jl text eol=lf
+
+# ReScript
+*.res text eol=lf
+*.resi text eol=lf
+
+# Ada
+*.ada text eol=lf diff=ada
+*.adb text eol=lf diff=ada
+*.ads text eol=lf diff=ada
+
+# Haskell
+*.hs text eol=lf
+
+# Chapel
+*.chpl text eol=lf
+
+# Scheme
+*.scm text eol=lf
+
+# Nix
+*.nix text eol=lf
+
+# ============
+# Documentation
+# ============
+*.md text eol=lf diff=markdown
+*.adoc text eol=lf
+*.txt text eol=lf
+
+# ============
+# Data/Config
+# ============
+*.json text eol=lf
+*.yaml text eol=lf
+*.yml text eol=lf
+*.toml text eol=lf
+
+# ============
+# Build/Config Files
+# ============
+.gitignore text eol=lf
 .gitattributes text eol=lf
-justfile       text eol=lf
-Makefile       text eol=lf
-Containerfile  text eol=lf
+Containerfile text eol=lf
+Justfile text eol=lf
+Makefile text eol=lf
 
+# ============
 # Scripts
-*.sh   text eol=lf
-
-# Binary
-*.png   binary
-*.jpg   binary
-*.gif   binary
-*.pdf   binary
-*.woff2 binary
-*.zip   binary
-*.gz    binary
+# ============
+*.sh text eol=lf
 
-# Lock files
-Cargo.lock  text eol=lf -diff
-flake.lock  text eol=lf -diff
+# ============
+# Lock Files (no diff)
+# ============
+Cargo.lock text eol=lf -diff
+flake.lock text eol=lf -diff

.github/workflows/bridge-forbidden-phrases.yml

@@ -15,20 +15,16 @@
 # reusable.yml should pick up this rule for all bridge-tagged repos.
 
 name: Bridge Forbidden Phrases
-
 on:
   push:
     branches: [main, master]
   pull_request:
   workflow_dispatch:
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
-
 permissions:
   contents: read
-
 jobs:
   check:
     name: docs/ECHO-TYPES-OCHRANCE-BRIDGE forbidden-phrases

.github/workflows/instant-sync.yml

@@ -1,16 +1,13 @@
 # SPDX-License-Identifier: MPL-2.0
 # Instant Forge Sync - Triggers propagation to all forges on push/release
 name: Instant Sync
-
 on:
   push:
     branches: [main, master]
   release:
     types: [published]
-
 permissions:
   contents: read
-
 jobs:
   dispatch:
     runs-on: ubuntu-latest
@@ -35,6 +32,5 @@ jobs:
               "sha": "${{ github.sha }}",
               "forges": ""
             }
-
       - name: Confirm
         run: echo "::notice::Propagation triggered for ${{ github.event.repository.name }}"

.github/workflows/mirror.yml

@@ -1,14 +1,11 @@
 # SPDX-License-Identifier: MPL-2.0
 name: Mirror to Git Forges
-
 on:
   push:
     branches: [main]
   workflow_dispatch:
-
 permissions:
   contents: read
-
 jobs:
   mirror:
     uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236

.github/workflows/secret-scanner.yml

@@ -1,19 +1,26 @@
 # SPDX-License-Identifier: MPL-2.0
 name: Secret Scanner
-
 on:
   pull_request:
   push:
     branches: [main]
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
-
 permissions:
   contents: read
-
 jobs:
   scan:
     uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
     secrets: inherit
+  trufflehog:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
+        with:
+          fetch-depth: 0
+      - name: TruffleHog Secret Scan
+        uses: trufflesecurity/trufflehog@6c05c4a00b91aa542267d8e32a8254774799d68d # v3.93.3
+        with:
+          extra_args: --only-verified --fail