ci: fix governance ReScript ban + add clusterfuzzlite build scaffold

The merged PR #19 surfaced two pre-existing CI failures that didn't
block the merge but should be fixed before more PRs land:

governance / Language anti-pattern policy:
- Estate-wide governance bundle in hyperpolymath/standards bans .res
  files by default. VeriSimDB legitimately uses 34 ReScript files for
  the VQL parser, federation registry, ABI bridge, and Playground UI
  (per CLAUDE.md language policy).
- Added .hypatia-ignore with explicit `cicd_rules/banned_language_file`
  entries for each .res file. The comment block documents the policy
  decision so future audits don't reopen this.

pr-fuzzing (ClusterFuzzLite):
- .clusterfuzzlite/ contained only project.yaml (language: rust).
  Missing build.sh meant the runner had no idea how to build the
  fuzz harnesses, so every PR-fuzzing run failed in 36s.
- Added build.sh that runs cargo fuzz build for both harnesses
  (fuzz_octad_id and fuzz_vql_parser) with the requested sanitizer.
- Added Dockerfile based on gcr.io/oss-fuzz-base/base-builder-rust.
- build.sh has commented-out seed corpus hooks for when we accumulate
  interesting inputs to bootstrap with.

https://claude.ai/code/session_01GeiWCLLoZmPdnjMMcy2buu

Author: claude

.clusterfuzzlite/Dockerfile

@@ -0,0 +1,7 @@
+# SPDX-License-Identifier: MPL-2.0
+# ClusterFuzzLite build environment for VeriSimDB
+FROM gcr.io/oss-fuzz-base/base-builder-rust
+
+COPY . $SRC/verisimdb
+WORKDIR $SRC/verisimdb
+COPY .clusterfuzzlite/build.sh $SRC/build.sh

.clusterfuzzlite/build.sh

@@ -0,0 +1,33 @@
+#!/bin/bash
+# SPDX-License-Identifier: MPL-2.0
+# ClusterFuzzLite build script for VeriSimDB
+#
+# Builds both fuzz harnesses with libfuzzer instrumentation and copies the
+# resulting binaries to $OUT (where ClusterFuzzLite expects them).
+#
+# Required env vars (set by ClusterFuzzLite runner):
+#   $OUT             — output directory for built fuzzer binaries
+#   $SRC             — source root (typically /src/verisimdb)
+#   $SANITIZER       — address | undefined | memory  (we honour via RUSTFLAGS)
+
+set -euo pipefail
+
+# cargo-fuzz drives libfuzzer; install it if missing.
+if ! command -v cargo-fuzz &>/dev/null; then
+    cargo install cargo-fuzz --locked
+fi
+
+# ── fuzz_octad_id — top-level fuzz crate ─────────────────────────────────
+cd "${SRC}/verisimdb/fuzz"
+cargo fuzz build --release --sanitizer="${SANITIZER:-address}"
+cp target/*/release/fuzz_octad_id "${OUT}/"
+
+# ── fuzz_vql_parser — rust-core fuzz crate ───────────────────────────────
+cd "${SRC}/verisimdb/rust-core/fuzz"
+cargo fuzz build --release --sanitizer="${SANITIZER:-address}"
+cp target/*/release/fuzz_vql_parser "${OUT}/"
+
+# Optional seed corpora — empty for now, will populate as we discover
+# interesting inputs.  Comment in once corpora exist:
+# cp -r "${SRC}/verisimdb/fuzz/corpus/fuzz_octad_id" "${OUT}/fuzz_octad_id_seed_corpus" 2>/dev/null || true
+# cp -r "${SRC}/verisimdb/rust-core/fuzz/corpus/fuzz_vql_parser" "${OUT}/fuzz_vql_parser_seed_corpus" 2>/dev/null || true

.hypatia-ignore

@@ -0,0 +1,46 @@
+# .hypatia-ignore — file-level exemptions from estate-wide hypatia rules
+#
+# ReScript (.res) files are permitted in this repository per CLAUDE.md
+# language policy.  ReScript powers:
+#   - src/vql/         — VQL parser, type checker, circuits, subtyping
+#   - src/registry/    — federation registry (Kraft consensus, metadata log)
+#   - src/abi/         — Idris2/ReScript ABI bridge
+#   - playground/      — VQL Playground web UI
+#   - connectors/clients/rescript/ — ReScript client SDK
+#
+# Each file is whitelisted by absolute repo path.
+
+cicd_rules/banned_language_file:examples/SafeDOMExample.res
+cicd_rules/banned_language_file:src/vql/VQLContext.res
+cicd_rules/banned_language_file:src/vql/VQLParser_test.res
+cicd_rules/banned_language_file:src/vql/VQLSubtyping.res
+cicd_rules/banned_language_file:src/vql/VQLCircuit.res
+cicd_rules/banned_language_file:src/vql/VQLExplain.res
+cicd_rules/banned_language_file:src/vql/VQLTypes.res
+cicd_rules/banned_language_file:src/vql/VQLError.res
+cicd_rules/banned_language_file:src/vql/VQLParser.res
+cicd_rules/banned_language_file:src/vql/VQLBidir.res
+cicd_rules/banned_language_file:src/vql/VQLProofObligation.res
+cicd_rules/banned_language_file:src/vql/VQLTypeChecker.res
+cicd_rules/banned_language_file:src/registry/MetadataLog.res
+cicd_rules/banned_language_file:src/registry/KRaftSerializer.res
+cicd_rules/banned_language_file:src/registry/Registry.res
+cicd_rules/banned_language_file:src/registry/KRaftCluster.res
+cicd_rules/banned_language_file:debugger/examples/SafeDOMExample.res
+cicd_rules/banned_language_file:playground/src/Examples.res
+cicd_rules/banned_language_file:playground/src/Formatter.res
+cicd_rules/banned_language_file:playground/src/App.res
+cicd_rules/banned_language_file:playground/src/DemoExecutor.res
+cicd_rules/banned_language_file:playground/src/Linter.res
+cicd_rules/banned_language_file:playground/src/VqlKeywords.res
+cicd_rules/banned_language_file:playground/src/Highlighter.res
+cicd_rules/banned_language_file:playground/src/ApiClient.res
+cicd_rules/banned_language_file:connectors/clients/rescript/src/VeriSimVql.res
+cicd_rules/banned_language_file:connectors/clients/rescript/src/VeriSimFederation.res
+cicd_rules/banned_language_file:connectors/clients/rescript/src/VeriSimProvenance.res
+cicd_rules/banned_language_file:connectors/clients/rescript/src/VeriSimDrift.res
+cicd_rules/banned_language_file:connectors/clients/rescript/src/VeriSimClient.res
+cicd_rules/banned_language_file:connectors/clients/rescript/src/VeriSimHexad.res
+cicd_rules/banned_language_file:connectors/clients/rescript/src/VeriSimTypes.res
+cicd_rules/banned_language_file:connectors/clients/rescript/src/VeriSimSearch.res
+cicd_rules/banned_language_file:connectors/clients/rescript/src/VeriSimError.res