policy: only t27 -- gate hand-written foreign code (lefthook + CI) #6510

Owner rule, 2026-10-05: no new pull request may contain code in other languages, bees must not write in other languages at all, and the git hooks must stop it.

What this issue asks for, in one pull request:

• The rule as t27: specs/policy/own_language.t27, a pure classifier from (path, git status letter) to ALLOW or DENY with a reason code, with test blocks and invariants. Allowed: .t27 specs, files under t27c's generated roots, prose and data, deletions. Denied: added or modified hand-written code in any other language.
• The executable classifier generated from that spec by t27c gen-c (gen/c/policy/own_language.c), never hand-edited.
• lefthook.yml: an own-language command on pre-commit (staged diff) and pre-push (origin/master...HEAD). No bypass.
• .github/workflows/own-language.yml: checks base...head of every pull request; the only override is the owner's label owner-approved-foreign.
• AGENTS.md: a short "Only t27" section above "t27b is written in t27", which now points at it.
• The bee task template: a line requiring bee pull requests to contain only .t27 and t27c-generated files.

Coordination: #6433 adds lefthook.yml with a gitleaks secret-gate command; the two files merge as a union of command lists.

After merge the owner marks the own-language check as required in branch protection.