feat(scripts+ci): swap governance TS-allowlist check to AffineScript-compiled .deno.js

.github/workflows/governance-reusable.yml

@@ -190,7 +190,14 @@ jobs:
         # `deno run` before the file-walker even starts — the script does not
         # import anything, so the lockfile is irrelevant to its execution.
         # See standards#294.
-        run: deno run --allow-read --no-lock .standards-checkout/scripts/check-ts-allowlist.ts
+        #
+        # Runs the AffineScript-compiled `.deno.js` (source of truth:
+        # `scripts/check-ts-allowlist.affine`). The .ts archetype is kept
+        # alongside for the regression suite (`scripts/tests/check-ts-
+        # allowlist-test.sh`) and for parallel-validation during the
+        # TS→AffineScript migration (standards#239 / #241). Retirement of
+        # the .ts is a separate follow-up after the dual-target window.
+        run: deno run --allow-read --no-lock .standards-checkout/scripts/check-ts-allowlist.deno.js
 
       # Shared escape hatch for the banned-language-file checks below.
       # Honours three exemption mechanisms (see

docs/EXEMPTION-MECHANISMS.adoc

@@ -137,8 +137,10 @@ across the estate. Three sub-layers:
 
 === 4a: Built-in path / filename allowlist
 
-Hard-coded in `scripts/check-ts-allowlist.ts`. Covers paths that are
-*always* exempt regardless of per-repo configuration:
+Hard-coded in `scripts/check-ts-allowlist.affine` (source of truth;
+compiled to `scripts/check-ts-allowlist.deno.js` which the workflow
+invokes). Covers paths that are *always* exempt regardless of per-repo
+configuration:
 
 * Directory segments: `bindings`, `tests`, `test`, `scripts`,
   `mcp-adapter`, `cli`, `vendor`, `examples`, `ffi`, `node_modules`,
@@ -230,11 +232,23 @@ sufficient. Most repos will pick one or the other.
   + new typed-infrastructure file. Owner picked the Layer-2.5 approach
   (standards#185) over the minimal regex-only fix (standards#183).
   This document seeds the doctrine.
+* AffineScript port (standards#283 seed, #310 compile/runtime fixes,
+  #311 workflow swap): `.ts` → `.affine` self-referential port under
+  the TS→AffineScript campaign (#239 / #241 STEP 2). The `.ts`
+  archetype is kept for the regression suite and parallel-validation;
+  the workflow now runs the compiled `.deno.js`. Retirement of the
+  `.ts` is a follow-up after the dual-target window.
 
 == Cross-references
 
 * `docs/HYPATIA-BASELINE-FORMAT.adoc` — the baseline file format.
 * `.machine_readable/hypatia-baseline.schema.json` — machine schema.
-* `scripts/check-ts-allowlist.ts` — the Deno detector behind Layer 4.
+* `scripts/check-ts-allowlist.affine` — the AffineScript source of
+  truth for the Layer 4 detector (since standards#283 / #310 / #311).
+* `scripts/check-ts-allowlist.deno.js` — the compiled artifact the
+  governance workflow runs.
+* `scripts/check-ts-allowlist.ts` — the Deno archetype, retained as the
+  regression-suite target (`scripts/tests/check-ts-allowlist-test.sh`)
+  and for parallel-validation during the TS→AS dual-target window.
 * `hyperpolymath/standards#????` — proposal that landed this consumer.
 * `hyperpolymath/hypatia` — the scanner that emits findings.