fix(ci): start the Governance job again and re-sync the coaptation receipt (#90)

## What
Two reds on main, fixed together because both are small and both are
about main drifting from what it declares.

## Governance workflow
The workflow called the reusable `governance-reusable.yml` of the
standards repository. That call fails with `startup_failure` and no job
(main runs at 21:35, 21:45 and 22:13 UTC). systemet hit the same thing
and replaced the call with a self-contained job, which is green there.
This takes that file unchanged: the same TypeScript and package-manager
policy, with the policy script checked out from
`metadatastician/standards` at a pinned commit.

Checked locally that anytype has no unallowlisted `.ts` files, no
npm/yarn/pnpm lockfiles and no root `tsconfig.json` or `Makefile`, so
the job should pass here. The first CI run on this PR is the real test.

## Coaptation receipt
#87 (`6a2` to `descriptiles`) changed `Mustfile.a2ml`, so the `must@…`
hash went stale and `just validate-coapt` reported drift. Regenerated
with `just coapt`. The only change is that hash; the band stays green
and no reading moved.

## Verified
- `coapt.sh --report` then `verify.sh`: in sync.
- `governance.yml` parses as YAML; policy preconditions hold locally.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01J1XmMC49T8sZ3uUuvrgB7y)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/governance.yml

@@ -1,23 +1,79 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
+#
+# Self-contained estate governance policy checks, after `governance.yml` of the
+# estate template (hyperpolymath/rsr-template-repo). The policy script comes
+# from metadatastician/standards at the commit in STANDARDS_PIN.
+#
+# The earlier form of this file called the reusable workflow `governance-reusable.yml` of the
+# standards repository. That call did not start: each run failed with no job.
+# This form runs the TypeScript and package-manager policy only.
 name: Governance
 
 on:
   push:
     branches: [main, master]
   pull_request:
-    branches: [main, master]
   workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
 permissions:
   contents: read
 
 jobs:
   governance:
-    uses: metadatastician/standards/.github/workflows/governance-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd
+    name: Estate Governance Policy
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
     permissions:
-      actions: read
       contents: read
-      security-events: write
+    env:
+      STANDARDS_PIN: 'e064539116c2dcfdf282a4749dbd58c69961c7e6'
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Checkout pinned standards policy scripts
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: metadatastician/standards
+          ref: e064539116c2dcfdf282a4749dbd58c69961c7e6
+          path: .standards-checkout
+          sparse-checkout: |
+            scripts
+            0-canon
+          sparse-checkout-cone-mode: true
+          persist-credentials: false
+
+      - name: Enforce TypeScript and npm/yarn runtime policy
+        run: |
+          set -euo pipefail
+          if [ -f .standards-checkout/scripts/check-ts-allowlist.sh ]; then
+            bash .standards-checkout/scripts/check-ts-allowlist.sh
+          fi
+          rm -rf .standards-checkout
+
+          bad_ts="$(git ls-files '*.ts' '*.tsx' | grep -vE '^(archetypes/|templates/|tests/fixtures/)' || true)"
+          if [ -n "$bad_ts" ]; then
+            echo "::error::Unallowlisted TypeScript files detected:"
+            printf '%s\n' "$bad_ts"
+            exit 1
+          fi
+
+          bad_locks="$(git ls-files 'package-lock.json' '**/package-lock.json' 'yarn.lock' '**/yarn.lock' 'pnpm-lock.yaml' '**/pnpm-lock.yaml' || true)"
+          if [ -n "$bad_locks" ]; then
+            echo "::error::Banned npm/yarn/pnpm lockfiles detected (use Deno or Bun per LANGUAGE-POLICY):"
+            printf '%s\n' "$bad_locks"
+            exit 1
+          fi
+
+          if [ -f tsconfig.json ] || [ -f Makefile ] || [ -f GNUmakefile ]; then
+            echo "::error::Banned root config (tsconfig.json / Makefile) detected"
+            exit 1
+          fi
+          echo "Governance runtime and language anti-pattern checks passed."

.machine_readable/coaptation/receipts/latest.a2ml

@@ -86,5 +86,5 @@ bust.sync-drift-between-repos = latent
 bust.contractile-parse-error = latent
 
 [provenance]
-contractiles = "intend@b5248bb14c9b must@20748d123686 trust@32805d174f53 adjust@8faad9ca0650 dust@c9b96a1959f8 bust@dd6a53e1fc9b"
+contractiles = "intend@b5248bb14c9b must@fbbcf90bc87f trust@32805d174f53 adjust@8faad9ca0650 dust@c9b96a1959f8 bust@dd6a53e1fc9b"
 descriptiles = "clade@1774a0b6a688 deed@f8d9d5bbaba0 ecosystem@f490b124bb19 agentic@f1102d5cb5ba anchor@f0707388115d"