docs(policy): ban ReScript explicitly and pin production installs

Addresses the two live static-analysis findings on this PR.

ReScript was absent from the BANNED table although canon bans it (destination
AffineScript), so the table read as permitting it.

Enforcement Rule 3 said `bun install --production` with no `--frozen-lockfile`,
so a lockfile mismatch silently re-resolved instead of failing, which defeats
the point of committing `bun.lock`.

Enforcement Rule 1 is deliberately untouched: standards#655 records that
collision as not resolvable unilaterally.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: hyperpolymath

.claude/CLAUDE.md

@@ -42,6 +42,7 @@ The following files in `.machine_readable/` contain structured project metadata:
 | Banned | Replacement |
 |--------|-------------|
 | TypeScript | AffineScript |
+| ReScript | AffineScript |
 | Deno | Bun |
 | Node.js | Bun |
 | npm | Bun |
@@ -66,7 +67,7 @@ Both are FOSS with independent governance (no Big Tech).
 
 1. **No new TypeScript files** - Convert existing TS to AffineScript
 2. **Use `package.json` + `bun.lock` for JS runtime deps** - Bun is npm-compatible; a manifest is REQUIRED
-3. **`bun install --production` for production deps** - resolved from `package.json`, pinned via `bun.lock`
+3. **`bun install --production --frozen-lockfile` for production deps** - resolved from `package.json` and pinned via `bun.lock`; `--frozen-lockfile` makes a lockfile mismatch a build failure rather than a silent re-resolve
 4. **No Go code** - Use Rust instead
 5. **No Python anywhere** - Use Julia for data/batch, Rust for systems, AffineScript for apps
 6. **No Kotlin/Swift for mobile** - Use Tauri 2.0+ or Dioxus