Clears the last four red checks on main, and replaces four config files
that a sweep had replaced with generic estate boilerplate.

## Gates

Rust CI (clippy -D warnings, was exit 101). ~32 lints. Most were
mechanical and taken from `cargo clippy --fix`; the rest are addressed
in two ways:

  - 19 single-element `&[x.clone()]` slices become
    `std::slice::from_ref(&x)`, which is what clippy asks for and drops
    a needless clone.
  - 5 `clippy::approx_constant` hits are a FALSE POSITIVE. Every one is
    the literal 3.14 used as arbitrary decimal test data — `abs(-3.14)
    == 3.14`, a JSON float round-trip, a channel send/receive. None of
    them mean pi. Substituting std::f64::consts::PI would change what
    the tests assert, so the test modules carry a narrowly scoped
    #[allow] with the reason written next to it.

  This failure was also masking three other jobs: Cargo audit, Cargo
  test and Coverage were all `skipped` behind it. Tests now run — 236
  pass, 0 fail.

Cargo Audit + Security (both red on RUSTSEC-2026-0190, unsoundness in
anyhow's Error::downcast_mut). anyhow is transitive, and 1.0.104 is
released, so this is a real fix rather than the time-boxed audit.toml
ignore that was planned: bumped 1.0.102 -> 1.0.104 and `cargo audit -D
warnings` now exits 0. No suppression file is needed.

ClusterFuzzLite (Docker build failed: "open Dockerfile: no such file or
directory"). The directory holds a Containerfile, per the estate's
podman-first naming, but ClusterFuzzLite hardcodes the path
`.clusterfuzzlite/Dockerfile`. Added Dockerfile as a symlink to
Containerfile, so the tool finds the name it demands while the estate
convention stays the single source of truth.

## Config files

These were carrying generic multi-language boilerplate that did not
describe this repository, and in two cases actively contradicted it.

  mise.toml declared `rust = "latest"` while rust-toolchain.toml pins
  1.96.0 — and that pin exists precisely because a drifting `stable`
  once broke this clippy gate with lints local clippy could not see. It
  also declared node, python, go, java, bun, npm, yarn, pnpm and pip,
  every one of which is on the BANNED list in this repo's own
  .claude/CLAUDE.md language policy. Worst, its [alias] block chained
  fallbacks such as `test = "cargo test || npm test || go test ./..."`,
  which turns a genuine cargo test failure into an attempt at two
  toolchains that do not exist here — a fake gate by construction.
  Reduced to a pointer at the real sources of truth.

  .tool-versions said `rust stable`, the same contradiction; now pinned
  to 1.96.0 alongside rust-toolchain.toml, with ocaml 4.14.2 from
  wokelang.opam. Lean stays owned by lean-toolchain alone.

  .editorconfig and .gitattributes both covered Elixir, ReScript,
  TypeScript and Zig — none of which are in this repository — while
  omitting Lean, Coq, ocamllex/menhir and WokeLang's own .woke/.wl
  sources. Rewritten to track `git ls-files`. .woke is 4-space per the
  examples.

  .gitignore dropped entries for absent languages and gained the
  proof-assistant artefacts that were missing (*.olean, *.ilean,
  .lake/, Idris *.ttc/*.ttm). Verified that no currently tracked file
  becomes ignored, and the tracked examples/math.wasm fixture is
  explicitly re-included.

  guix.scm had a licence field that could never have worked:
    (license ((@@ (guix licenses) license) "MPL-2.0" "..."))
  `@@` reaches into a non-exported binding, and the `license` record
  constructor takes three fields but was given two. Because guix is not
  installed on the development host, nothing ever evaluated this file
  and the fault sat unnoticed. Now `(license mpl2.0)`, which is what
  (guix licenses) exports. Confirmed the file parses and that the old
  form raises unbound-variable.

## Verified locally

  cargo clippy --workspace --all-targets -- -D warnings   PASS
  cargo fmt --all -- --check                              PASS
  cargo test --workspace                                  PASS (236)
  cargo audit -D warnings                                 PASS
  guix.scm parses under guile                             PASS
  all 22 workflows structurally valid for Actions         PASS
  no tracked file newly ignored                           PASS

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>