K9 gate is now real — first-ever run decomposes into content debt here + an ecosystem-level catch-22 #30

PR #29 repointed k9-validate-action to k9-ecosystem/validate-action, so the K9 job executes for the first time (it previously died at job setup — the gate was decorative). It fails with real findings. Decomposition:

A. Content debt in this repo (fixable here):

• Files missing the K9! magic first line: container/stapeln/deploy.k9.ncl, .machine_readable/arrival-pack/claude-md.k9.ncl, the contractiles/{must,dust,trust} files (the self-validating/template-* files have it)
• Hunt-level files missing signature / signature_required
• Missing pedigree = { ... } blocks
• deploy.k9.ncl carries uninstantiated {{PROJECT_NAME}} template residue

B. Ecosystem-level catch-22 (upstream, owner ruling): the validator demands K9! as the first line, but per the estate's measured finding the K9! line is not valid Nickel and fails nickel typecheck on every .k9.ncl including the canonical template. The two gates make mutually exclusive demands. systemet runs no nickel gate, so the conflict is latent here — but any repo running both cannot be green. Resolution belongs in k9-ecosystem (e.g. magic-in-comment # K9!, or the validator accepting a comment form, or typecheck stripping the first line).

Doing (A) makes this repo green under the current validator without breaking anything local. (B) needs a spec ruling first if both gates are ever to coexist.

Filed by the session that repointed the actions; A2ML validation passes as of #29.