fix(ci): estate-wide foundational remediation

Author: hyperpolymath

.machine_readable/root-allow.txt

@@ -69,3 +69,5 @@ container/                 # may host Containerfile if not at build/
 .pre-commit-config.yaml    # TODO: relocate to ci/.pre-commit-config.yaml after invocation pattern decided
 affinescript/              # AffineScript source subtree consumed by this template
 tools/                     # TODO: consolidate with scripts/ or document the split (pending decision)
+.hypatia-ignore
+CLAUDE.md