Estate sweep: Tooling Version Integrity rollout — completion tracking (burble#39 lesson)

[hyperpolymath]

Tracking issue for full rollout + closure of the Tooling Version Integrity initiative. Spawned from the burble#39 post-mortem (unpinned just 1.14.0 vs import? ≥1.19.0 → parse-time crash misdiagnosed for months as failing tests, frozen behind continue-on-error on a wrong root cause).

Done

• P0 — only live armed unversioned install fixed: ci: pin just@1.34.0 in build-gossamer-gui — Tooling Version Integrity (cf. burble#39) hypatia#270 (build-gossamer-gui.yml). Estate sweep confirms the bug surface is fully bounded: only burble (fixed, burble#40 merged) and hypatia (#270) ever installed just unversioned. No 50-repo pinning epidemic.
• P1+P2+P3 — policy: Tooling Version Integrity — institutionalise the burble#39 lesson #94:
  • TOOLING-VERSION-INTEGRITY-POLICY.adoc (5 rules + post-mortem)
  • tasks/tooling-integrity-lint.sh (R0 just-floor blocking, R1 unversioned-install blocking, R4 unexplained-continue-on-error advisory-first; self-tested)
  • contractiles/must/Mustfile canonical dependency-free tooling-version-integrity check
  • live Mustfile dogfoods the lint; Justfile carries the Rule-2 floor annotation
  • governance-reusable.yml inline R0+R1 gate → propagates estate-wide via the existing workflow_call line, no per-repo PR

Remaining / owned handoffs (inherently multi-session or external)

• contractile generator regen is out-of-band. The generator repo is not in the working estate. The new canonical contractiles/must/Mustfile check reaches consumers only when someone holding the generator runs contractile gen-just --dir contractiles and repos re-adopt. Until then, governance-reusable.yml is the live propagation path (no regen needed).
• R4 advisory → --strict promotion. ~9 advisory continue-on-error findings in standards alone (estate-wide more). Promote per-repo as each soft-gate is explained (dated suppression or by-design:). Do not flip estate-wide at once — that would itself become an ignored gate (the exact anti-pattern).
• governance-reusable adoption audit. Confirm every estate repo invokes governance-reusable.yml (6 consumers seen locally; full estate unverified) so the inline R0/R1 gate actually runs everywhere.
• burble#35 item 2 (cross-ref burble#39). Final Elixir gate re-arm is blocked on a green/red CI signal — GitHub runners queued ~3h+ (external). burble#39 carries the line-pinned static prediction (RED via Burble.Store/VeriSimDB at app-boot); remediation A (test-env child filtering) is identified but, per the burble#40 "confirm before fixing" discipline, must wait for the real CI log. A watcher is live.

Closure criteria

• standards#94 + hypatia#270 merged
• contractile regen performed (or a permanent non-regen propagation path ratified)
• governance-reusable adoption audited estate-wide
• burble#35 closed (item 2 re-armed once CI confirms green, or remediation-A PR landed then re-armed)
• R4 promoted to --strict in repos with no unexplained soft-gates

Refs: burble#35, burble#39, #94, hyperpolymath/hypatia#270