resolve: conflicts for #90 (chore/apply-foundation-ci-fixes-20260911) (#94)

Supersedes #90 (chore/apply-foundation-ci-fixes-20260911), which is
unmergeable as it stands.

## What this is

One linear commit on top of current `main` containing exactly the net
effect of
merging `main` into `chore/apply-foundation-ci-fixes-20260911` with
every conflict resolved.
Linear and single-commit because the branch rules require linear history
and
allow squash merges only.

Original PR: #90

## Conflicts and how each was resolved

| Path | Conflict | Resolution |
|---|---|---|
| `.github/workflows/codeql.yml` | content | NEEDS_HUMAN |
| `.github/workflows/governance.yml` | content | NEEDS_HUMAN |
| `.github/workflows/hypatia-scan.yml` | content | NEEDS_HUMAN |
| `.github/workflows/scorecard.yml` | content | NEEDS_HUMAN |
| `0-AI-MANIFEST.a2ml` | content | NEEDS_HUMAN |
| `EXPLAINME.adoc` | content | NEEDS_HUMAN |
| `README.adoc` | content | NEEDS_HUMAN |
| `TOPOLOGY.md` | modify/delete: deleted in main, modified in PR |
TAKE_PR |

### Why `guix.scm` is kept, not deleted

The PR carries `fix(ci): remove erroneous squisher-corpus guix.scm
placeholder`.
That was correct when the branch was cut — the merge-base file was a
template
with unexpanded `{{PROJECT_NAME}}` tokens. **`main` has since replaced
it
with a real package definition** (name, version, `coreutils bash`
inputs;
`grep -c '{{'` now returns 0). Honouring the deletion would destroy a
working
file, so main's version is kept.

### Why the workflow pins stay at main's

The PR branch pins older `hyperpolymath/standards` revisions than
`main`:

| Pin | Date | Position |
|---|---|---|
| `d7c22711` | 2026-06-26 | PR side |
| `81dbf2dd` | 2026-07-21 | main side |
| `d135b05b` | 2026-06-24 | PR side |
| `c65436ee` | 2026-07-20 | main side |

Taking the PR side would downgrade the reusable workflows by about a
month.
Most of these files conflicted only because `main` added a trailing
newline on
the same last line the PR re-pinned.

## Verification

Asserted before push, then re-confirmed by an independent `git
ls-remote`:

- exactly 1 commit ahead of `main`, 0 behind
- no conflict markers anywhere in the tree
- `git merge-tree` against `main` exits 0 — genuinely conflict-free
- no `standards` pin in the tree that is unreachable from
`standards/main`
- `guix.scm` present wherever `main` has it

Remote SHA: `71b6d33c854e`

## Net effect on `main`

```
.editorconfig                               | 39 +++--------------------------
 .gitattributes                              | 11 +++-----
 .gitignore                                  | 35 +++++++++++++-------------
 .machine_readable/descriptiles/AGENTIC.a2ml |  2 +-
 .nojekyll                                   |  0
 nqc/web/lib/bs/src/Msg.d                    |  0
 nqc/web/lib/bs/src/Route.d                  |  0
 7 files changed, 25 insertions(+), 62 deletions(-)
```

Author: hyperpolymath

.editorconfig

@@ -2,67 +2,34 @@
 # https://editorconfig.org
 
 root = true
-
 [*]
 charset = utf-8
 end_of_line = lf
 indent_size = 2
 indent_style = space
 insert_final_newline = true
 trim_trailing_whitespace = true
-
 [*.md]
 trim_trailing_whitespace = false
-
 [*.adoc]
-trim_trailing_whitespace = false
-
 [*.rs]
 indent_size = 4
-
 [*.ex]
-indent_size = 2
-
 [*.exs]
-indent_size = 2
-
 [*.zig]
-indent_size = 4
-
 [*.ada]
 indent_size = 3
-
 [*.adb]
-indent_size = 3
-
 [*.ads]
-indent_size = 3
-
 [*.hs]
-indent_size = 2
-
 [*.res]
-indent_size = 2
-
 [*.resi]
-indent_size = 2
-
 [*.ncl]
-indent_size = 2
-
 [*.rkt]
-indent_size = 2
-
 [*.scm]
-indent_size = 2
-
 [*.nix]
-indent_size = 2
-
 [Justfile]
-indent_style = space
-indent_size = 4
-
 [justfile]
-indent_style = space
-indent_size = 4
+# SPDX-License-Identifier: MPL-2.0
+[Makefile]
+indent_style = tab

.gitattributes

@@ -2,7 +2,6 @@
 # RSR-compliant .gitattributes
 
 * text=auto eol=lf
-
 # Source
 *.rs    text eol=lf diff=rust
 *.ex    text eol=lf diff=elixir
@@ -18,28 +17,23 @@
 *.scm   text eol=lf
 *.ncl   text eol=lf
 *.nix   text eol=lf
-
 # Docs
 *.md    text eol=lf diff=markdown
 *.adoc  text eol=lf
 *.txt   text eol=lf
-
 # Data
 *.json  text eol=lf
 *.yaml  text eol=lf
 *.yml   text eol=lf
 *.toml  text eol=lf
-
 # Config
 .gitignore     text eol=lf
 .gitattributes text eol=lf
 justfile       text eol=lf
 Makefile       text eol=lf
 Containerfile  text eol=lf
-
 # Scripts
 *.sh   text eol=lf
-
 # Binary
 *.png   binary
 *.jpg   binary
@@ -48,7 +42,10 @@ Containerfile  text eol=lf
 *.woff2 binary
 *.zip   binary
 *.gz    binary
-
 # Lock files
 Cargo.lock  text eol=lf -diff
 flake.lock  text eol=lf -diff
+*.a2ml  text eol=lf linguist-language=TOML
+*.zig   text eol=lf
+.editorconfig  text eol=lf
+.tool-versions text eol=lf

.gitignore

@@ -9,92 +9,74 @@ Thumbs.db
 *~
 .idea/
 .vscode/
-
 # Build
 /target/
 /_build/
 /build/
 /dist/
 /out/
-
 # Dependencies
 /node_modules/
 **/node_modules/
 /vendor/
 /deps/
 /.elixir_ls/
-
 # Rust
 # Cargo.lock  # Keep for binaries
-
 # Elixir
 /cover/
 /doc/
 *.ez
 erl_crash.dump
-
 # Julia
 *.jl.cov
 *.jl.mem
 /Manifest.toml
-
 # ReScript
 /lib/bs/
 /.bsb.lock
-
 # Python (SaltStack only)
 __pycache__/
 *.py[cod]
 .venv/
-
 # Ada/SPARK
 *.ali
 /obj/
 /bin/
-
 # Haskell
 /.stack-work/
 /dist-newstyle/
-
 # Chapel
 *.chpl.tmp.*
-
 # Secrets
 .env
 .env.*
 *.pem
 *.key
 secrets/
-
 # Test/Coverage
 /coverage/
 htmlcov/
-
 # Logs
 *.log
 /logs/
-
 # Temp
 /tmp/
 *.tmp
 *.bak
-
 # Crash recovery artifacts
 ai-cli-crash-capture/
 sync_report*.txt
 .directory
-
 # VeriSimDB app data — belongs in standalone verisimdb-data repo, NOT here.
 # See: https://github.com/hyperpolymath/verisimdb-data
 # LLMs: DO NOT store application data in the VeriSimDB source tree.
 # Each project gets its own VeriSimDB instance + port + volume.
 verisimdb/verisimdb-data/
-
 # ReScript/OCaml compiler artifacts
 *.cmt
 *.cmti
 *.cmi
-
 # asdf version manager
 .tool-versions
 target/
@@ -105,3 +87,20 @@ deps/
 .cache/
 build/
 dist/
+# Build (unanchored to match nested monorepo paths)
+zig-out/
+zig-cache/
+.zig-cache/
+# Machine-readable locks
+.machine_readable/.locks/
+# Rust build artefacts (innervation tools)
+inline-annotations/extractor/target/
+k9-coordination-protocol/tools/k9-init/target/
+hooks/playbook-to-recipe/target/
+inline-annotations/extractor/Cargo.lock
+k9-coordination-protocol/tools/k9-init/Cargo.lock
+hooks/playbook-to-recipe/Cargo.lock
+.verisimdb/ecosystem-ingest/target/
+.verisimdb/ecosystem-ingest/Cargo.lock
+# Backup/scratch files (never commit)
+*.backup

.machine_readable/descriptiles/AGENTIC.a2ml

@@ -23,5 +23,5 @@ can-create-files = true
 # - Never place state files in repository root (must be in .machine_readable/)
 # - Never use AGPL license (use PMPL-1.0-or-later)
 # - Never add per-database implementation content (source, schemas, migrations,
-#   per-database docs, query-language implementations) to this COORDINATION repo;
+#   per-database docs, database-language implementations) to this COORDINATION repo;
 #   it belongs in that database's own repo (see REGISTRY.adoc)