feat(tin-2423): substrate-boundary conformance validator (ledger item 30)

[Jesssullivan]

Summary

Fans out the substrate-boundary conformance validator to this repo, per TIN-2423 and
operator-ratified ledger item 30. Reference implementation: GF PR #1016
(feat/tin-2423-substrate-boundary on tinyland-inc/GloriousFlywheel).

Asserts ADR-008 "logical replaceability" as a checked invariant instead of prose: this
repo's code surfaces may reach the blahaj substrate only through named interfaces recorded
(with provenance) in config/substrate-boundary-allowlist.json. Docs (*.md) stay exempt.

Correction (adversarial-verify REWORK — fixed)

The version of scripts/validate-substrate-boundary.py originally pushed on this branch
(e0f0983) predated the SELF-exclusion fix that landed on GF main (6fb1f50). Because
CODE_GLOBS includes scripts/**, and the validator's own source contains the literal
detection strings (tinyland-inc/blahaj, ../blahaj, ~/git/blahaj, key = "blahaj/) in
its regex definitions and self_test() fixtures, the un-fixed script flagged itself.
Confirmed by re-running the validator against e0f0983 directly: 8 un-allowlisted
violations, exit 1 — not the "CLEAN / 0 violations" this PR originally (and incorrectly)
reported below. That prior claim was stale evidence, not a real passing run.

Fixed by porting the identical GF-main fix: added
SELF = Path(__file__).resolve().relative_to(REPO) right after REPO, and excluded it in
tracked_code_files()'s filter (Path(p) != SELF). Nothing else in the script changed.

Scan result: CLEAN (re-verified post-fix, post git add -A)

$ python3 scripts/validate-substrate-boundary.py --self-test
substrate-boundary self-test passed

$ python3 scripts/validate-substrate-boundary.py
substrate-boundary validation passed (0 allowlisted hit(s), 0 violations)

No tinyland-inc/blahaj repo-ref, ../blahaj/~/git/blahaj path-reach, or key = "blahaj/
state-key hits anywhere in this repo's code surfaces (tofu/**, .github/workflows/**,
scripts/**, Justfile, flake.nix, MODULE.bazel, **/*.bzl, **/BUILD.bazel,
tinyland.repo.json). The allowlist ships empty.

The dormant blahaj_app_install tofu module block (count = var.blahaj_installation_id > 0 ? 1 : 0, default 0) resolves its module source through the operator-injected
var.gf_modules_source placeholder (git::ssh://git@github.com/ORG/REPO.git//...), never a
literal tinyland-inc/blahaj string — consistent with this repo's existing "personal Pages
spoke, blahaj installation dormant" posture (see tofu/README.md, AGENTS.md).

What changed

• scripts/validate-substrate-boundary.py — byte-identical to the GF reference except
  CODE_GLOBS, adapted to this repo's layout (tofu/**, plus tinyland.repo.json since
  it declares gitops_receiver); plus the SELF-exclusion fix (see Correction above).
• config/substrate-boundary-allowlist.json — empty allowed array (nothing to allowlist).
• scripts/check-conformance.sh — new checklist item 17, matching the existing
  ok/no/man idiom.
• Justfile — new substrate-boundary-check recipe.
• CI: already covered — .github/workflows/ci.yml already runs just conformance, which
  now includes this check.

Test plan

• python3 scripts/validate-substrate-boundary.py --self-test passes
• python3 scripts/validate-substrate-boundary.py passes (0 hits, 0 violations) —
  re-verified after git add -A, verbatim output above
• bash scripts/check-conformance.sh passes with new item 17 green (16 pass, 0 fail,
  7 manual)
• CI green on this PR (main loop merges on green per house rules — not merging here)

Committed with --no-verify -c commit.gpgsign=false per the TIN-2423 fanout task's stated
house rules for this batch.