refactor(root): move root artefacts to their canonical locations

[hyperpolymath]

refactor(root): move root artefacts to their canonical locations

Applies the estate root-shape rollout: files that are not root-level by
necessity move to where their tooling and the estate canon expect them, and
every reference to them is updated in the same change.

• .envrc
• .machine_readable/contractiles/Justfile
• Justfile
• QUICKSTART-MAINTAINER.adoc
• RSR_OUTLINE.adoc
• build/guix.scm
  (from guix.scm)
  -> build/guix.scm
• .github/CONTRIBUTING.md
  (new)
• CONTRIBUTING.adoc
  (deleted)
• docs/accessibility/README.adoc

Verified with git apply --check against current main before committing; no
behaviour change intended, the Justfile entry points keep working.

[github-actions]

🔍 Hypatia Security Scan

Findings: 299 issues detected

Severity	Count
🔴 Critical	218
🟠 High	14
🟡 Medium	67

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "No permissions declaration -- add permissions: read-all",
    "type": "missing_permissions",
    "file": "main-estate-audit.yml",
    "action": "add_permissions",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Job `triage` in label-triage.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": "label-triage.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "triage"
  },
  {
    "reason": "Job `sync` in labels.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": "labels.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "sync"
  },
  {
    "reason": "Job `estate-audit` in main-estate-audit.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": "main-estate-audit.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "estate-audit"
  },
  {
    "reason": "Required file missing (condition: public_repo)",
    "type": "missing_requirement",
    "file": "SECURITY.md",
    "action": "create",
    "rule_module": "cicd_rules",
    "severity": "high"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/proven-servers/proven-servers/bindings/python/proven_servers/siem.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/proven-servers/proven-servers/bindings/python/proven_servers/stun.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/proven-servers/proven-servers/bindings/python/proven_servers/appserver.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/proven-servers/proven-servers/bindings/python/proven_servers/ospf.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/proven-servers/proven-servers/bindings/python/proven_servers/opcua.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence