fix(ci): start the Governance job again and re-sync the coaptation receipt

.github/workflows/governance.yml

@@ -1,23 +1,79 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
+#
+# Self-contained estate governance policy checks, after `governance.yml` of the
+# estate template (hyperpolymath/rsr-template-repo). The policy script comes
+# from metadatastician/standards at the commit in STANDARDS_PIN.
+#
+# The earlier form of this file called the reusable workflow `governance-reusable.yml` of the
+# standards repository. That call did not start: each run failed with no job.
+# This form runs the TypeScript and package-manager policy only.
 name: Governance
 
 on:
   push:
     branches: [main, master]
   pull_request:
-    branches: [main, master]
   workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
 permissions:
   contents: read
 
 jobs:
   governance:
-    uses: metadatastician/standards/.github/workflows/governance-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd
+    name: Estate Governance Policy
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
     permissions:
-      actions: read
       contents: read
-      security-events: write
+    env:
+      STANDARDS_PIN: 'e064539116c2dcfdf282a4749dbd58c69961c7e6'
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Checkout pinned standards policy scripts
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: metadatastician/standards
+          ref: e064539116c2dcfdf282a4749dbd58c69961c7e6
+          path: .standards-checkout
+          sparse-checkout: |
+            scripts
+            0-canon
+          sparse-checkout-cone-mode: true
+          persist-credentials: false
+
+      - name: Enforce TypeScript and npm/yarn runtime policy
+        run: |
+          set -euo pipefail
+          if [ -f .standards-checkout/scripts/check-ts-allowlist.sh ]; then
+            bash .standards-checkout/scripts/check-ts-allowlist.sh
+          fi
+          rm -rf .standards-checkout
+
+          bad_ts="$(git ls-files '*.ts' '*.tsx' | grep -vE '^(archetypes/|templates/|tests/fixtures/)' || true)"
+          if [ -n "$bad_ts" ]; then
+            echo "::error::Unallowlisted TypeScript files detected:"
+            printf '%s\n' "$bad_ts"
+            exit 1
+          fi
+
+          bad_locks="$(git ls-files 'package-lock.json' '**/package-lock.json' 'yarn.lock' '**/yarn.lock' 'pnpm-lock.yaml' '**/pnpm-lock.yaml' || true)"
+          if [ -n "$bad_locks" ]; then
+            echo "::error::Banned npm/yarn/pnpm lockfiles detected (use Deno or Bun per LANGUAGE-POLICY):"
+            printf '%s\n' "$bad_locks"
+            exit 1
+          fi
+
+          if [ -f tsconfig.json ] || [ -f Makefile ] || [ -f GNUmakefile ]; then
+            echo "::error::Banned root config (tsconfig.json / Makefile) detected"
+            exit 1
+          fi
+          echo "Governance runtime and language anti-pattern checks passed."

.machine_readable/coaptation/receipts/latest.a2ml

@@ -86,5 +86,5 @@ bust.sync-drift-between-repos = latent
 bust.contractile-parse-error = latent
 
 [provenance]
-contractiles = "intend@b5248bb14c9b must@20748d123686 trust@32805d174f53 adjust@8faad9ca0650 dust@c9b96a1959f8 bust@dd6a53e1fc9b"
+contractiles = "intend@b5248bb14c9b must@fbbcf90bc87f trust@32805d174f53 adjust@8faad9ca0650 dust@c9b96a1959f8 bust@dd6a53e1fc9b"
 descriptiles = "clade@1774a0b6a688 deed@f8d9d5bbaba0 ecosystem@f490b124bb19 agentic@f1102d5cb5ba anchor@f0707388115d"