ci(language-policy): drop SaltStack Python carveout (closes reposystem#32)

.github/workflows/governance-reusable.yml

@@ -312,9 +312,7 @@ jobs:
           RES_FILES=$(git ls-files '*.res' || true)
           GO_FILES=$(git ls-files '*.go' || true)
           PY_FILES=$(git ls-files '*.py' \
-            | grep -v salt | grep -v _states \
-            | grep -v _modules | grep -v pillar | grep -v venv \
-            | grep -v __pycache__ || true)
+            | grep -v venv | grep -v __pycache__ || true)
           MAKE_FILES=$(git ls-files 'Makefile' 'Makefile.*' '*.mk' \
             | grep -v '\.github/' || true)
           JAVA_FILES=$(git ls-files '*.java' '*.kt' '*.kts' || true)
@@ -328,7 +326,7 @@ jobs:
 
           enforce "ReScript files" "use AffineScript instead" "$RES_FILES"
           enforce "Go files" "use Rust/WASM instead" "$GO_FILES"
-          enforce "Python files" "only allowed for SaltStack" "$PY_FILES"
+          enforce "Python files" "Python is fully banned — use AffineScript/Rust/SPARK/Julia (SaltStack carveout removed 2026-01-03)" "$PY_FILES"
           enforce "Makefiles" "use Mustfile/justfile instead" "$MAKE_FILES"
           enforce "Java/Kotlin files" "use Rust/Tauri/Dioxus instead" "$JAVA_FILES"
           enforce "Swift files" "use Tauri/Dioxus instead" "$SWIFT_FILES"
@@ -430,7 +428,7 @@ jobs:
       - name: Summary
         run: |
           echo "RSR language/package policy passed — allowed: AffineScript, Deno,"
-          echo "WASM, Rust, OCaml, Haskell, Guile/Scheme, SaltStack (Python)."
+          echo "WASM, Rust, OCaml, Haskell, Guile/Scheme."
 
   package-policy:
     name: Guix primary / Nix fallback policy

consent-aware-http/.github/workflows/language-policy.yml

@@ -8,8 +8,8 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - name: Enforce language policies
         run: |
-          # Block new Python files (except SaltStack)
-          NEW_PY=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.py$' | grep -v 'salt' || true)
+          # Block new Python files (Python fully banned 2026-01-03 — SaltStack carveout removed)
+          NEW_PY=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.py$' || true)
           if [ -n "$NEW_PY" ]; then
             echo "❌ New Python files detected. Use Rust or AffineScript instead."
             echo "$NEW_PY"

rhodium-standard-repositories/.github/workflows/language-policy.yml

@@ -11,8 +11,8 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - name: Enforce language policies
         run: |
-          # Block new Python files (except SaltStack)
-          NEW_PY=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.py$' | grep -v 'salt' || true)
+          # Block new Python files (Python fully banned 2026-01-03 — SaltStack carveout removed)
+          NEW_PY=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.py$' || true)
           if [ -n "$NEW_PY" ]; then
             echo "❌ New Python files detected. Use Rust or AffineScript instead."
             echo "$NEW_PY"

rhodium-standard-repositories/satellites/consent-aware-http/.github/workflows/language-policy.yml

@@ -7,8 +7,8 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - name: Enforce language policies
         run: |
-          # Block new Python files (except SaltStack)
-          NEW_PY=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.py$' | grep -v 'salt' || true)
+          # Block new Python files (Python fully banned 2026-01-03 — SaltStack carveout removed)
+          NEW_PY=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.py$' || true)
           if [ -n "$NEW_PY" ]; then
             echo "❌ New Python files detected. Use Rust or AffineScript instead."
             echo "$NEW_PY"

rhodium-standard-repositories/satellites/palimpsest-license/.github/workflows/language-policy.yml

@@ -7,8 +7,8 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: Enforce language policies
         run: |
-          # Block new Python files (except SaltStack)
-          NEW_PY=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.py$' | grep -v 'salt' || true)
+          # Block new Python files (Python fully banned 2026-01-03 — SaltStack carveout removed)
+          NEW_PY=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.py$' || true)
           if [ -n "$NEW_PY" ]; then
             echo "❌ New Python files detected. Use Rust or AffineScript instead."
             echo "$NEW_PY"