Pre-release cleanups: dead primitive, statuses, posture, pipeline outcome

Andrew Dunnrequested to merge
pre-tag-cleanups into main

What

Four pre-tag passes ahead of v1.2.0, from a burden audit run against the two real consumers:

  1. Dead primitive dropped. check_file_exists_when had zero consumers after the agents-md slim. Nine primitives; guard/ARCHITECTURE/AGENTS counts follow.
  2. Status sweep. ai-assisted, changelog, contributing flip to enforcing on schedule (enforced_since: v1.2.0); security-md and agents-md land their deferred v1.1.0 flips. README contracts table reconciled.
  3. Posture self-FAIL fixed. README links the rendered compliance page; the posture self-deviation retires. just check-self: 18/18, zero raw FAILs.
  4. Pipeline check slimmed to outcome. The new workflow: shape assertion failed BOTH real consumers (they fire MR validation via per-job rules:, an equally conforming shape) — the same class of mistake the agents-md slim just walked back. Only merge_request_event is asserted; the workflow: block stays as the recommended default. check-one pipeline verified green against both consumers.

Plus three accuracy fixes: the contributing SKILL no longer claims an OFAC check that does not exist, the naming check comment says skips (matching _lib.sh semantics), and the registry notes release is documentation-only.

Validation

just guard, just validate, just check-self (18/18), just build, just agent all green; just check-one STANDARD=pipeline passes against gitlab-simulation and gitlab-contribution.

Merge request reports