refactor(governance): subsume language-policy.yml + add deno-ci-reusable (semantics-level fix for estate-template drift)

[hyperpolymath]

Why

Multiple PRs in the estate inbox are failing on a single bug class:
per-repo workflow templates copy-drift away from the canonical estate
policy. The repro that surfaced it was self-inflicted: PR #167 to this
repo failed its own `Check for Banned Languages` step because
`language-policy.yml` does a naive `find -name "*.py"` that bypasses
`.hypatia-baseline.json` — even though the file in question is already
acknowledged there.

The same gap appears in absolute-zero, maa-framework, and any other repo
that still ships a local copy of either workflow. Patching each copy
individually treats the symptom; the foundational fix is to delete the
copies and consume a single reusable workflow.

What changes

File	Change
`.github/workflows/governance-reusable.yml`	language-policy job extended: now also catches Makefiles, Java/Kotlin, Swift, Flutter/Dart, V-lang manifests, ATS2 sources, and `package.json` with runtime `"dependencies"`. All go through the existing `enforce()` / `is_exempt()` helpers — so every newly-covered check honours `.hypatia-baseline.json`, `.hypatia-ignore`, and inline `# hypatia:ignore …` pragmas.
`.github/workflows/language-policy.yml`	Deleted. `governance.yml` (the thin wrapper) already calls `governance-reusable.yml` via `workflow_call`, so estate coverage is unchanged — but the bug class becomes structurally impossible: the naive find-based check no longer exists to be drift-copied.
`.github/workflows/deno-ci-reusable.yml`	New. Replaces the broken `rescript-deno-ci.yml` template that's been failing across the estate. Detects Deno targets/tests/config first and only runs lint/fmt/test/check when applicable. Declares top-level `permissions:`. Drops the banned `npx rescript` step and the vestigial security-grep job.

What was broken in the old `rescript-deno-ci.yml`

Observed across absolute-zero #41 and tma-mark2 #41:

• `deno test --allow-all` ran unconditionally and exit-1'd on `No test modules found` in repos without Deno tests.
• `deno lint` / `deno fmt --check` ran unconditionally and exit-1'd on `No target files found` in repos without JS/TS targets.
• Missing top-level `permissions:` declaration — tripped governance-reusable's workflow-security-linter.
• Still ran `npm install && npx rescript` even though ReScript was banned in new code 2026-04-30 (per `.claude/CLAUDE.md`).
• Vestigial `security` job that grep'd for permission strings and did nothing with the output.

Downstream rollout

Each repo carrying `rescript-deno-ci.yml` or its own `language-policy.yml` is now eligible to delete its copy and consume the reusable:

```yaml
jobs:
deno-ci:
uses: hyperpolymath/standards/.github/workflows/deno-ci-reusable.yml@main
```

Follow-up PRs will land per-repo against absolute-zero, tma-mark2, etc.

Relationship to PR #167

#167 patches the tsconfig/rescript-config check in this same file to honour `.hypatia-baseline.json`. This PR is orthogonal: #167 fixes a single step's exemption logic; this PR consolidates two workflows so the duplication itself goes away. Either can land first; rebase is trivial.

Test plan

• Governance reusable still passes on this PR (its own CI run will exercise the consolidated language-policy job, including against this repo's `a2ml-templates/state-scm-to-v2.py` baseline entry — which the reusable already honours).
• Workflow-security-linter check passes (deno-ci-reusable has SPDX + top-level `permissions:`).
• Once merged, run a fanout PR converting `absolute-zero` + `tma-mark2` to the wrappers and confirm green.

[github-actions]

🔍 Hypatia Security Scan

Findings: 205 issues detected

Severity	Count
🔴 Critical	64
🟠 High	115
🟡 Medium	26

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/deno-ci-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "deno-ci-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/a2ml-templates/state-scm-to-v2.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/a2ml/bindings/deno/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/lol/test/vitest.config.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/k9-svc/bindings/deno/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "Agda postulate assumes without proof -- potential soundness hole (4 occurrences, CWE-704)",
    "type": "agda_postulate",
    "file": "/home/runner/work/standards/standards/lol/proofs/theories/information_theory.agda",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/standards/standards/lol/src/abi/Locale.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "Wildcard CORS -- restrict to specific origins or use env var (1 occurrences, CWE-942)",
    "type": "js_wildcard_cors",
    "file": "/home/runner/work/standards/standards/consent-aware-http/examples/reference-implementations/deno/aibdp_middleware.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence