fix: instantiate bitfuckit from the RSR template

[hyperpolymath]

Summary

bitfuckit was scaffolded from rsr-template-repo and never instantiated: literal {{PLACEHOLDER}} tokens survived throughout, including in the .zig FFI sources — which meant the Zig genuinely did not parse (export fn {{project}}_init() etc.). This PR cures it for real, not just papers over it with packaging.

Identity used throughout comes from the repo's actual registration in reposystem/config/tools.ncl: role = utility, summary = "Ada/SPARK repository auditor (health, compliance, security posture)", status = extracted. No features beyond that description were invented.

What changed

• ~80 files had RSR identity placeholders substituted: README, governance/security/conduct docs, .github/ community health files, .machine_readable/ state and contractile files, container/ packaging, .devcontainer/, docs/onboarding+status+attribution, examples/, Justfile top variables.
• Left untouched by design: docs-template/, ADR/audit *-TEMPLATE.adoc copy-per-instance files, self-validating/examples/ and template-{hunt,kennel,yard}.k9.ncl (generic reusable scaffolding), machine-readable-design/ (describes the RSR standard generically, not this repo).
• Zig FFI (src/interface/ffi/): {{PROJECT}}/{{project}} → bitfuckit in main.zig, build.zig, integration_test.zig. Also fixed three real pre-existing bugs the placeholder text had been masking:
  • Handle was declared opaque but had fields (illegal in Zig) → changed to a plain struct
  • std.heap.c_allocator needs explicit libc linking that build.zig never wired up → switched to page_allocator (safe: this library only ever frees through its own bitfuckit_free/bitfuckit_free_string)
  • callconv(.C) is stale syntax under Zig 0.16 → callconv(.c)
  • Verified with the real toolchain (zig 0.16.0): zig fmt --check src/interface/ffi → exit 0, zig build → exit 0, zig test src/main.zig → exit 0 (3/3 tests), zig test test/integration_test.zig → exit 0 (1/1)
• Justfile: top project/REPO vars fixed; every echo "TODO" stub recipe either replaced with a real, verified command or deleted outright where nothing exists to back it (run, run-verbose, install — no build target exists yet; bench, readiness — no harness exists). Mirrored into .machine_readable/contractiles/Justfile, which a Dustfile invariant expects to match the root Justfile but had drifted even further out of sync.
• .machine_readable/6a2/{STATE,ECOSYSTEM}.a2ml and the contractiles/*file.a2ml family previously asserted "this repository IS rsr-template-repo, the canonical template" — rewritten to describe bitfuckit's actual, honest state (ABI/FFI seam compiles and passes its own tests; no Ada/SPARK audit logic exists yet). Where inherited body content still describes the template's own concerns, it's flagged in-file rather than fabricated into fictional bitfuckit-specific content.
• Removed template machinery that tested the substitution mechanism itself, now moot post-instantiation: scripts/validate-template.sh, tests/e2e/template_instantiation_test.sh, benches/template_bench.sh, .machine_readable/ai/PLACEHOLDERS.adoc. Verified none are invoked from workflows/Justfile/build/just/*.just before deleting.
• .github/settings.yml landmine fixed: unsubstituted name: "{{REPO}}" would have made probot/settings try to rename the repo to the literal string {{REPO}} on the next push to main.
• PGP placeholders removed (not fabricated) from SECURITY.md / .well-known/security.txt — no PGP key is actually published for this project.

Test plan

• zig fmt --check src/interface/ffi → exit 0
• zig build (in src/interface/ffi) → exit 0
• zig test src/main.zig → exit 0, 3/3 passing
• zig test test/integration_test.zig → exit 0, 1/1 passing
• just build, just test, just fmt-check, just deps all run the intended real commands and pass
• All 27 .github/workflows/*.yml files still parse as valid YAML
• Grep-verified no disease {{[A-Z_]+}} / {{project}} / {{PROJECT}} tokens remain outside the deliberately-excluded generic template files
• Owner review of the honest STATE.a2ml/ECOSYSTEM.a2ml rewrite and the removed Justfile recipes

Note: just aspect (now wired to the real tests/aspect_tests.sh) currently fails on two pre-existing, unrelated issues documented in docs/status/TEST-NEEDS.adoc: a gitignored .zig-cache build artifact getting swept into the SPDX-header scan, and doc-prose substring matches for "sorry"/"Admitted" in verification/proofs/. Not fixed here — out of scope for an instantiation pass, and real script bugs rather than identity placeholders.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com

[sonarqubecloud]

Quality Gate passed

Issues
6 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud