…+ contractiles + 4 mandatory workflows + stapeln) (#30)

## Summary

Bring `echo-types` to the RSR template floor — 23 new files covering
githealth, RSR docs, dotfiles, the AI manifest, the canonical 4
mandatory workflows, contractiles, and a stapeln/Containerfile pair
sized for the proof-artefact-carrier shape this repo ships.

This is the second of three echo-types PRs:

1. PR #29 — `.scm` → `.a2ml` for 6a2 files + Justfile `make` → `just`.
(Merged or pending.)
2. **This PR** — RSR floor scaffolding.
3. Forthcoming — recognition PR against `hyperpolymath/standards` (Agda
+ echo-types as canonical loss-with-residue foundation).

## What's added

### Githealth (5 files, `.md` per the doc-format rule)

- `CHANGELOG.md` — Keep-a-Changelog format, with the staged 7-commit
integration (per STATE.a2ml § integration) under `[Unreleased]`.
- `CODE_OF_CONDUCT.md` — Contributor Covenant 2.1 reference.
- `CONTRIBUTING.md` — DCO, branch rules, pre-merge checklist with
**estate banned-pattern list** (no new `believe_me` / `assert_total` /
`postulate` / `sorry` / `Admitted` / `unsafeCoerce` / `Obj.magic`),
**EI-2 discipline** (do not reopen; cite STATE), and **naming traps**
(ModeGraded canonical, ModeGrade forbidden).
- `SECURITY.md` — disclosure policy + posture (formal-methods library;
no networked attack surface; report proof-soundness concerns to same
address).
- `0-AI-MANIFEST.a2ml` — agent gating: may-edit, may-not-edit,
escalation triggers (especially the EI-2 mention procedure that routes
to `PLAYBOOK.a2ml § on-EI-2-mention`).

### RSR docs (5 files)

- `EXPLAINME.adoc` — one-paragraph + one-sentence + status snapshot.
- `QUICKSTART-DEV.adoc` — toolchain, first build, common failures
(banned-pattern detection, naming-trap, EI-2 reopen).
- `QUICKSTART-USER.adoc` — depend on echo-types as a library; cite the
formalism.
- `QUICKSTART-MAINTAINER.adoc` — release procedure; new-bridge addition
checklist; escalation patterns.
- `TOPOLOGY.adoc` — repo layout + cross-repo dependency direction
(foundation: depends on `hyperpolymath/standards` schemas only) +
verification posture table per track.

### Dotfiles (3 files)

- `.editorconfig` — LF, UTF-8, 2-space default; 4 for Rust; tab for
Justfile/Makefile.
- `.envrc` — `use flake` (flake.nix is parked per Intentfile).
- `.tool-versions` — agda 2.7.0, ghc 9.8.2, cabal 3.12.1.0, rust 1.82.0,
just 1.40.0.

### Contractiles (4 files)

- `contractiles/Mustfile.a2ml` — invariants:
license/readme/security/changelog/spdx-headers/no-banned-files/agda-typechecks/no-believe_me/no-postulates/no-sorry/mode-graded-canonical/rust-compiles.
- `contractiles/Trustfile.a2ml` — license content / no secrets / images
pinned (post-pin) / **ei-2-record-intact** check.
- `contractiles/Dustfile.a2ml` — source-rollback / clean-build (Agda
`.agdai`s + Rust `target/`) / resync-from-template.
- `contractiles/Intentfile.a2ml` — RSR conformance / proofs (Buchholz
close, Q2.1/Q2.3/Q2.4 discharge) / process / explicitly-parked (recipe
v0.2+, full 2D iff theorem).

### Mandatory RSR workflows (4 files)

Copied verbatim from `hyperpolymath/standards/.github/workflows/` (the
canonical 4 per `hypatia-rules/rsr-self-compliance.a2ml
@required_workflows`):

- `.github/workflows/hypatia-scan.yml`
- `.github/workflows/mirror.yml`
- `.github/workflows/scorecard.yml`
- `.github/workflows/rsr-antipattern.yml`

(Existing `agda.yml` workflow remains; it's the proof-typecheck CI
lane.)

### Container build

- `stapeln.toml` — layered Chainguard build with **echo-types-runtime**
as a `static` (artefact-carrier) image: holds the type-checked `proofs/`
tree for downstream Agda projects to mount, not a service. `@sha256:`
pins are `TODO(scaffold)` markers.
- `Containerfile` — podman-build fallback shape.

## What's deliberately NOT in this PR

Per the staged sequence and the maintainer's existing parked migrations:

- `readme.adoc` (lowercase) → `README.adoc` (canonical caps) — leaving
the lowercase as-is so this PR stays focused on additions; rename is a
follow-up.
- `roadmap.adoc` / `roadmap-gates.adoc` — same reason.
- `README.md` (duplicate of `readme.adoc`) — rationalisation needs a
content review beyond mechanical renaming.
- `DOCUMENTATION_STATUS.md` and `docs/*.md` (~7 files) — `.md` → `.adoc`
per the doc-format rule, but content review is needed; follow-up PR.
- `flake.nix` / `guix.scm` — toolchain reproducibility files, listed in
Intentfile but require deliberate authoring.
- `.machine_readable/` reorganisation to match
`hyperpolymath/standards`'s contractile-trident shape
(`.machine_readable/contractiles/<verb>/...`) — substantial, separate
PR.
- `Abstract-Echo-Types` and `arghda-core/README.md` — kept as-is (need
content judgement).

## Why merge this

It brings echo-types from "minimum-viable" file presence to the RSR
template floor as defined in
`hyperpolymath/standards/.meta/REQUIRED-FILES.adoc` (extension fix
pending — see standards PR #33). Once this lands, downstream tooling
that audits hyperpolymath repos for floor conformance (e.g.
`idaptik-port/tools/scaffold-component.{py,my} --audit`) will report
this repo as conformant.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>