fix(ci): resolve the four standing CI/CD failures at their roots

[hyperpolymath]

Every one of these was red on main on every push. Fixed at source, not suppressed.

Check	Root cause	Fix
🟡 Estate rules	flake.nix not on the root allowlist	removed (Guix-only ruling)
🟡 OpenSSF best-practices	unfilled {{PLACEHOLDER}} tokens in 3 required files	filled / removed
🟡 RSR self-use (dogfooding)	two uses: actions that 404	replaced with inline checks
Dependabot github_actions	same 404 actions — the updater cannot resolve them	same fix

1. flake.nix — the sole estate-rules blocker

scripts/check-root-shape.sh reported exactly one offender. flake.nix is debris
from the 07-21 sweep and contradicts the 2026-05-18 ruling that the estate is
Guix-primary with the Nix fallback retired — the file even documents itself as
"the Nix fallback tier". Removed. build/guix.scm is untouched, so
🔴 Gate: Guix-only package policy is unaffected (it only checks for the presence
of *.scm).

Now: PASS: root matches allowlist (45 entries, 46 permitted).

If you would rather keep it, the alternative is git mv flake.nix build/ — say the
word and I will swap the approach.

2. Placeholder tokens

• .github/SECURITY.md still carried its own "TEMPLATE INSTRUCTIONS (delete
  this block before publishing)" header, and advertised a PGP key that does not
  exist ({{PGP_KEY_URL}}, {{PGP_FINGERPRINT}}). Both removed — pointing users
  at an unfetchable key is worse than saying plainly that there isn't one.

• STATE.a2ml / ECOSYSTEM.a2ml were verbatim copies of rsr-template-repo's
  manifests: project = "rsr-template-repo", the template's purpose, and
  phase = maintenance / maturity = production. They now describe Haec
  (0.1.0, design/experimental) and its real pipeline position
  (workbench → haec → trope-checker).

  This is the template self-name leak — it misdirects any tooling that keys
  off these files.

3. Two actions that do not exist

hyperpolymath/a2ml-validate-action  → HTTP 404
hyperpolymath/k9-validate-action    → HTTP 404

They failed at "Set up job" on every push, so they never validated anything —
continue-on-error: true merely hid that they were inert. An unresolvable action
also breaks Dependabot's github_actions updater, which is why that job was
failing as well: one root cause, two symptoms.

Replaced with inline checks of the envelope contract that genuinely exists:

• non-empty, valid UTF-8, SPDX-License-Identifier present;
• for K9, the magic first line — K9! for .k9, # K9! for .k9.ncl so
  nickel typecheck still parses the file.

Their limits are stated in the workflow itself: they do not parse the A2ML
grammar or typecheck Nickel. That still needs the real validators. This is a
smaller claim than the 404'd actions implied, but unlike them it actually runs.

Also added SPDX headers to 6 .a2ml manifests that had none — REUSE
compliance, and it stops the new check being vacuous.

Verified locally

root-shape .................. PASS (45/46)
openssf placeholder check ... PASS
A2ML envelope check ......... PASS (119 manifests)
K9 envelope check ........... PASS (10 contracts)
workflow YAML ............... ALL OK (every file has ≥1 live job)

Deliberately not changed

CLADE.a2ml still declares canonical-name = "rsr-template-repo" with the
template's registry UUID (a5ea1382-…), clade prefix rm, and forge URLs pointing
at the template. Those are assigned by gv-clade-index; inventing replacements
would corrupt that registry, so Haec needs a real clade assignment. Flagging
rather than guessing.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud