ci(deed): gate CI on .deed; leftover .a2ml is a hard fail

A2ML is retired (standards #837). Machine-readable manifests are
renamed .a2ml → .deed. Repo deed affinescript_chora.deed is the
s-expression DEED grammar. tools/check-deed-gates.sh +
deed-validate.yml + the ci.yml build job refuse STATE.a2ml /
a2ml-validate / leftover *.a2ml. check-doc-truthing reads STATE.deed.

Author: hyperpolymath

.github/CONTRIBUTING.md

@@ -6,7 +6,7 @@ how to set up a working tree, file useful bugs, and submit changes.
 
 For the language itself, start from [`README.adoc`](../README.adoc). For
 project state, blockers, and next-actions, see
-[`.machine_readable/descriptiles/STATE.a2ml`](../.machine_readable/descriptiles/STATE.a2ml).
+[`.machine_readable/descriptiles/STATE.deed`](../.machine_readable/descriptiles/STATE.deed).
 
 ’’’’’
 
@@ -47,7 +47,7 @@ Tested on OCaml 4.14.2 (the constraint in `dune-project` is `>=`
     ├── packages/            # Aggregate JS/TS/ binding packages
     ├── editors/             # Editor integrations
     ├── js/                  # `js_of_ocaml` playground (built into `playground.bc.js`)
-    ├── .machine_readable/   # Machine-readable metadata (`.a2ml`) — see 0-AI-MANIFEST.a2ml
+    ├── .machine_readable/   # Machine-readable metadata (`.deed`) — see 0-AI-MANIFEST.deed
     ├── .github/             # CI workflows, issue templates
     │   └── CONTRIBUTING.md  # This file
     ├── CODE_OF_CONDUCT.md
@@ -85,7 +85,7 @@ template](.github/ISSUE_TEMPLATE/bug_report.md) and include:
 ### Suggesting Features
 
 **Before suggesting:** 1. Skim [`docs/ROADMAP.adoc`](../docs/ROADMAP.adoc)
-and `.machine_readable/descriptiles/STATE.a2ml`. 2. Search existing
+and `.machine_readable/descriptiles/STATE.deed`. 2. Search existing
 issues and discussions.
 
 **When suggesting:** use the [feature request
@@ -150,7 +150,7 @@ dune runtest     # must be green
 dune fmt         # optional — auto-formats with ocamlformat
 ```
 
-The `methodology.a2ml` file lists the canonical gate set. CI will rerun
+The `methodology.deed` file lists the canonical gate set. CI will rerun
 `build` + `runtest` plus the security, lint, and policy workflows in
 `.github/workflows/`.
 

.github/workflows/ci.yml

@@ -108,11 +108,14 @@ jobs:
         if: ${{ !cancelled() }}
         # Single toolchain-free gate enforcing both halves of the doc-truthing
         # MONITOR: the presence invariants (DOC-04/05 — banner pointers, matrix
-        # primacy + anti-over-claim section, STATE.a2ml mirror keys) AND the
+        # primacy + anti-over-claim section, STATE.deed mirror keys) AND the
         # over-claim ratchet (DOC-08/09 — fails any NEW backend-breadth /
         # "production-ready" / stdlib-% phrase beyond tools/doc-overclaims.allow).
         # See tools/check-doc-truthing.sh.
         run: ./tools/check-doc-truthing.sh
+      - name: DEED manifest gate (A2ML retired)
+        if: ${{ !cancelled() }}
+        run: ./tools/check-deed-gates.sh
       - name: Soundness-ledger anti-staleness gate
         if: ${{ !cancelled() }}
         # docs/SOUNDNESS.adoc is the single source of truth for soundness-hole

.github/workflows/deed-validate.yml

@@ -0,0 +1,22 @@
+# This workflow is managed by gh actions-lock.
+# SPDX-License-Identifier: MPL-2.0
+# DEED manifest gate. A2ML is retired; leftover *.a2ml fails CI.
+name: "DEED Manifest Validation"
+on:
+  pull_request:
+  push:
+    branches: [main]
+permissions: read-all
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+jobs:
+  deed-validate:
+    name: Validate DEED manifests
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7.0.1
+      - name: Run DEED gates
+        run: ./tools/check-deed-gates.sh