refactor(root): move root artefacts to their canonical locations

Applies the estate root-shape rollout: files that are not root-level by
necessity move to where their tooling and the estate canon expect them, and
every reference to them is updated in the same change.

  * .github/hooks/validate-a2ml.sh
      (from .githooks/validate-a2ml.sh)
      ->   .github/hooks/validate-a2ml.sh
  * .github/hooks/validate-k9.sh
      (from .githooks/validate-k9.sh)
      ->   .github/hooks/validate-k9.sh
  * .github/workflows/dogfood-gate.yml
  * .gitignore
  * .machine_readable/root-allow.txt
  * Containerfile
  * Justfile
  * scripts/validate-template.sh
  * src/interface/abi.ipkg
      (from abi.ipkg)
      ->   src/interface/abi.ipkg

Verified with `git apply --check` against current main before committing; no
behaviour change intended, the Justfile entry points keep working.

Author: hyperpolymath

.githooks/validate-a2ml.sh .github/hooks/validate-a2ml.sh.githooks/validate-a2ml.sh renamed to .github/hooks/validate-a2ml.sh

@@ -42,7 +42,7 @@ jobs:
 
       - name: Validate A2ML manifests
         if: steps.detect.outputs.count > 0
-        run: bash .githooks/validate-a2ml.sh
+        run: bash .github/hooks/validate-a2ml.sh
       - name: Write summary
         run: |
           A2ML_COUNT="${{ steps.detect.outputs.count }}"
@@ -87,7 +87,7 @@ jobs:
 
       - name: Validate K9 contracts
         if: steps.detect.outputs.k9_count > 0
-        run: bash .githooks/validate-k9.sh
+        run: bash .github/hooks/validate-k9.sh
       - name: Write summary
         run: |
           K9_COUNT="${{ steps.detect.outputs.k9_count }}"

.githooks/validate-k9.sh .github/hooks/validate-k9.sh.githooks/validate-k9.sh renamed to .github/hooks/validate-k9.sh

@@ -120,6 +120,6 @@ dist/
 !/build/
 !/build/**
 
-# ...but never track Idris2 typecheck output. `idris2 --typecheck abi.ipkg`
+# ...but never track Idris2 typecheck output. `idris2 --typecheck src/interface/abi.ipkg`
 # writes compiled .ttc/.ttm under build/ttc/; these are generated artifacts.
 /build/ttc/

.github/workflows/dogfood-gate.yml

@@ -31,7 +31,6 @@ CHANGELOG.adoc             # Current changelog after the AsciiDoc migration.
 # ─── Build entry points (must live at root for their tooling) ────────────────
 Justfile                   # delegates phases to build/just/*.just
 coordination.k9            # repo-local session binding (template-mandated)
-abi.ipkg                   # Idris2 package for the ABI seam; sourcedir=src/interface (estate canon: root-level *-abi.ipkg). Single case-consistent src/interface/Abi/ dir. Typecheck: `idris2 --typecheck abi.ipkg`.
 
 # ─── Conventional dotfiles (tool-required at root) ───────────────────────────
 .editorconfig
@@ -99,5 +98,5 @@ mise.toml                  # toolchain pin read by mise. Estate canon is .tool-v
 #     these are this project's real top-level shape. Moving them would
 #     break every path that references them, to satisfy a map that was
 #     never written for it. Read from the estate-rules gate's own output.
-.githooks/                  # Top-level component directory of this project.
+.github/hooks/                  # Top-level component directory of this project.
 REQUIRES_INITIALISATION.md  # Project documentation.

.gitignore

@@ -27,7 +27,7 @@
 #   ABI proofs should install Idris2 via upstream pack
 #   (https://github.com/stefan-hoeck/idris2-pack) or the Idris2 project's own
 #   instructions on a host with a Scheme implementation already available,
-#   then typecheck with `idris2 --typecheck abi.ipkg` / `pack typecheck
+#   then typecheck with `idris2 --typecheck src/interface/abi.ipkg` / `pack typecheck
 #   abi.ipkg`.
 #
 #   The Zig FFI side (src/interface/ffi/) is likewise out of scope here: it

.machine_readable/root-allow.txt

@@ -109,7 +109,7 @@ clean-all: clean
 
 # Run all tests: Idris2 ABI typecheck + Zig unit/integration tests
 test *args:
-    idris2 --typecheck abi.ipkg
+    idris2 --typecheck src/interface/abi.ipkg
     cd src/interface/ffi && zig build test {{args}}
 
 # Run tests with verbose output
@@ -186,7 +186,7 @@ fmt-check:
 # Lint: there is no separate Idris2/Zig linter, so this re-runs the
 # compilers in check-only mode, which is where both surface real warnings.
 lint:
-    idris2 --typecheck abi.ipkg
+    idris2 --typecheck src/interface/abi.ipkg
     cd src/interface/ffi && zig build
 
 # ═══════════════════════════════════════════════════════════════════════════════

Containerfile

@@ -307,8 +307,8 @@ fi
 # path / import breakage that a bare per-file `idris2 --check` masks as a
 # tolerated "module name does not match file name" warning.
 if command -v idris2 &> /dev/null; then
-    if [ -f "$REPO_ROOT/abi.ipkg" ]; then
-        if (cd "$REPO_ROOT" && idris2 --typecheck abi.ipkg) > /dev/null 2>&1; then
+    if [ -f "$REPO_ROOT/src/interface/abi.ipkg" ]; then
+        if (cd "$REPO_ROOT" && idris2 --typecheck src/interface/abi.ipkg) > /dev/null 2>&1; then
             log_pass "Idris2 ABI typechecks (abi.ipkg)"
         else
             log_error "Idris2 ABI does NOT typecheck (abi.ipkg)"

Justfile

@@ -14,7 +14,7 @@
 -- A bare `idris2 --check src/interface/Abi/Foo.idr` still warns ("module name
 -- does not match file name") because Idris derives the expected module from the
 -- full path; that is expected. Use the package for a real typecheck:
---   idris2 --typecheck abi.ipkg      (or --build)
+--   idris2 --typecheck src/interface/abi.ipkg      (or --build)
 --
 -- The RSR validators accept either Abi/ (canonical, case-consistent) or a
 -- lowercase abi/ for downstream repos that ship lowercase — but never both.
@@ -27,7 +27,7 @@ authors = "Jonathan D.A. Jewell"
 
 brief = "Formally-typed ABI/FFI seam (Idris2 type + layout proofs) for an RSR-templated repository"
 
-sourcedir = "src/interface"
+sourcedir = "."
 
 depends = base