fix(ci): three CI blockers — dead rsr-antipattern ref, K9 gap, placeholder FP

[hyperpolymath]

Summary

Fixes the three CI blockers keeping the estate's PR queue stuck, as
diagnosed for this repo (full per-blocker root-cause detail is in the
commit message):

• lint-workflows (unpinned action, rsr-antipattern.yml:15): the
  referenced reusable (rsr-antipattern-reusable.yml) has never
  existed on hyperpolymath/standards. It's dead, retired estate-wide
  per docs/audits/audit-reusables-convergence-2026-05-26.adoc, and
  superseded by governance.yml (already present here). Deleted
  rather than pinned to an unresolvable reference.
• Validate K9 contracts (8 errors / 10 files): 6 were a shared
  k9-ecosystem/validate-action scope bug, fixed at the source in
  fix(validate-action): exclude non-pedigree files from K9 checks k9-ecosystem#21 (with a local stopgap override here).
  The remaining 2 were a genuine container/deploy.k9.ncl defect
  (missing K9! line, pedigree hidden behind a let-binding, PLUS
  leftover un-instantiated {{SERVICE_NAME}}/{{REGISTRY}}/{{PORT}}
  tokens) — fixed directly.
• openssf-compliance: false-positived on ECOSYSTEM.a2ml's notes
  field, which documented the {{PLACEHOLDER}} mechanism using the
  literal token shape. Reworded (same false-positive class as
  hypatia#243).

Test plan

• bash validate-action/validate-k9.sh (k9-ecosystem, with the
  new paths-ignore) → Errors: 0 (was 8)
• grep -rnE '^[[:space:]]+uses:' .github/workflows/ | grep -v '@[a-f0-9]{40}'
  → empty (was 1 match)
• Reproduced the openssf-compliance placeholder-check step locally
  → 0 files flagged (was 1)
• python3 -c "import tomllib; tomllib.load(...)" on the edited
  .a2ml files → parses clean
• All touched/remaining workflow YAML parses via yaml.safe_load
  (pre-existing, unrelated e2e.yml parse error noted separately,
  not touched by this PR)

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gitar-bot]

CI failed: The CI check `check-root-shape.sh` failed because several files and directories in the repository root are not present on the allowlist.

Overview

Found 1 failure related to the repository root shape validation check (check-root-shape.sh) across 1 analyzed log, indicating unapproved files/directories present in the project root.

Failures

Root Shape Check Failure (confidence: high)

• Type: build
• Affected jobs: 90105373040
• Related to change: yes
• Root cause: Files and directories (ARCHITECTURE.md, CODE_OF_CONDUCT.md, Containerfile, GOVERNANCE.md, LICENSES/, MAINTAINERS, mise.toml) exist in the repository root but are not permitted by the root shape policy allowlist.
• Suggested fix: Add justified entries for these files/directories to .machine_readable/root-allow.txt or move them into the appropriate subdirectories.

Summary

• Change-related failures: 1 root shape check failure due to unallowed files in the repository root.
• Infrastructure/flaky failures: 0
• Recommended action: Update .machine_readable/root-allow.txt to include the new root files/directories or relocate them to comply with the repository shape rules.

Code Review ✅ Approved 1 resolved / 1 findings

Removes the dead rsr-antipattern reference, fixes K9 contract validation errors, and resolves the openssf-compliance placeholder false positive. However, hardcoding values in deploy.k9.ncl breaks template rendering for this repository.

✅ 1 resolved

✅ Bug: Hardcoding contractiles values breaks deploy.k9.ncl templating

📄 container/deploy.k9.ncl:22 📄 container/deploy.k9.ncl:97 📄 container/deploy.k9.ncl:98 📄 container/deploy.k9.ncl:117 📄 container/deploy.k9.ncl:127 📄 container/deploy.k9.ncl:138 📄 container/deploy.k9.ncl:153
This is a template repo: build/just/init.just sed-substitutes {{SERVICE_NAME}}, {{PORT}}, {{REGISTRY}}, {{IMAGE}} across every text file including *.ncl, and container/README.adoc states all container files use {{PLACEHOLDER}} tokens replaced by init. By baking contractiles-deploy, ghcr.io/hyperpolymath/contractiles, 8080, and literal contractiles into deploy.k9.ncl, a downstream repo scaffolded via just init will silently inherit contractiles' identity in its deploy contract — the substitution finds nothing to replace, and the init-time 'remaining placeholders' check passes with no warning. Note the string fields (name = "{{SERVICE_NAME}}-deploy", image = "{{REGISTRY}}/{{SERVICE_NAME}}", script echoes) are already valid Nickel and never needed changing; only bare port = {{PORT}} is a genuine Nickel syntax error. Prefer restoring the placeholder tokens and excluding deploy.k9.ncl from K9 validation (via the paths-ignore mechanism this PR already adds) rather than instantiating the template in-place.

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}