refactor: migrate all banned Python to Deno (clean history, replaces #59) (#60)

## Summary

Clean-history replacement for #59 (closed). Eliminates the 4 remaining
non-SaltStack Python files — the ones tripping the `Check for Banned
Languages` / `antipattern-check` banned-language CI gates — by porting
each to **Deno**, an allowed runtime.

Delivered as a **single commit off `main`** so that no commit anywhere
in this PR's history introduces the example credential-like strings. (On
#59, an intermediate commit re-added pre-existing fake
`token`/`signature` example literals; `gitleaks-action` scans
per-commit, so a follow-up fix couldn't clear it. This branch carries
the inert `EXAMPLE-*` placeholders from the first and only commit.)

| Was (Python) | Now (Deno) | Notes |
|---|---|---|
| `a2ml/scripts/contractiles-a2ml-tool.py` | `…-tool.js` | JSON emit
**byte-identical** to old `json.dumps(sort_keys=True, indent=2)` —
verified against `tests/contractiles/expected/*.json`. Wrappers + a2ml
docs call `deno run`. |
| `avow-protocol/.../examples/python/stamp_example.py` |
`examples/deno/stamp_example.js` | `ctypes` → `Deno.dlopen`; fake
literals → inert `EXAMPLE-*`; zig FFI README updated. |
| `consent-aware-http/.../python/{aibdp_middleware,example_server}.py`
(+README/reqs) | `…/deno/` on `Deno.serve` | manifest moved, README
ported, nodejs cross-link fixed. |

Verified in-sandbox (Node shim; no Deno here): byte-identical emit,
correct validate exit codes, `node --check` clean on all 4 files, no
Python remains under either CI banned-language filter.

CODEOWNERS policy (#58) is **not** included here — it already merged to
`main`.

## Test plan

- [ ] `gitleaks` passes (no fake secrets in any commit)
- [ ] `Check for Banned Languages` / `antipattern-check` no longer fail
on Python (pre-existing ReScript `.res` debt is separate/out of scope)
- [ ] `cd a2ml && bash scripts/contractiles-a2ml-test.sh` (needs `deno`)
- [ ] `deno run --allow-read --allow-net
consent-aware-http/examples/reference-implementations/deno/example_server.js`
+ the curl checks

https://claude.ai/code/session_01GTo7dz32ZgxuHXefv8BGqn

---
_Generated by [Claude
Code](https://claude.ai/code/session_01GTo7dz32ZgxuHXefv8BGqn)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

a2ml/docs/CONTRACTILES-A2ML-V1.adoc

@@ -109,6 +109,6 @@ The validator and emitter support explicit types:
 
 [source,bash]
 ----
-python3 scripts/contractiles-a2ml-tool.py validate --type mustfile tests/contractiles/fixtures/invalid-mustfile.a2ml
-python3 scripts/contractiles-a2ml-tool.py emit --type trustfile contractiles/trust/Trustfile.a2ml /tmp/trustfile.json
+deno run --allow-read --allow-write scripts/contractiles-a2ml-tool.js validate --type mustfile tests/contractiles/fixtures/invalid-mustfile.a2ml
+deno run --allow-read --allow-write scripts/contractiles-a2ml-tool.js emit --type trustfile contractiles/trust/Trustfile.a2ml /tmp/trustfile.json
 ----

a2ml/docs/RELEASE-CHECKLIST-CONTRACTILES-A2ML-V1.adoc

@@ -5,7 +5,7 @@
 == Pre-Release
 
 - [ ] Specs updated: `docs/CONTRACTILES-A2ML-V1.adoc` and `contractiles/spec/contractiles-v1.json`
-- [ ] Validator/emitter tool updated: `scripts/contractiles-a2ml-tool.py`
+- [ ] Validator/emitter tool updated: `scripts/contractiles-a2ml-tool.js`
 - [ ] Fixtures updated: `tests/contractiles/fixtures/*`
 - [ ] Expected outputs updated: `tests/contractiles/expected/*`
 - [ ] CI workflow present: `.github/workflows/contractiles-a2ml.yml`

a2ml/docs/RELEASE-NOTES-CONTRACTILES-A2ML-V1.adoc

@@ -30,7 +30,7 @@ just contractiles-k9-validate
 
 * `docs/CONTRACTILES-A2ML-V1.adoc`
 * `contractiles/spec/contractiles-v1.json`
-* `scripts/contractiles-a2ml-tool.py`
+* `scripts/contractiles-a2ml-tool.js`
 * `tests/contractiles/fixtures/*`
 * `.github/workflows/contractiles-a2ml.yml`
 

a2ml/scripts/contractiles-a2ml-emit.sh

@@ -6,12 +6,13 @@ root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
 out_dir="${1:-$root/build/contractiles}"
 mkdir -p "$out_dir"
 
-tool="$root/scripts/contractiles-a2ml-tool.py"
+tool="$root/scripts/contractiles-a2ml-tool.js"
+runtool() { deno run --quiet --allow-read --allow-write "$tool" "$@"; }
 
-python3 "$tool" emit "$root/contractiles/must/Mustfile.a2ml" "$out_dir/mustfile.json"
-python3 "$tool" emit "$root/contractiles/trust/Trustfile.a2ml" "$out_dir/trustfile.json"
-python3 "$tool" emit "$root/contractiles/dust/Dustfile.a2ml" "$out_dir/dustfile.json"
-python3 "$tool" emit "$root/contractiles/lust/Intentfile.a2ml" "$out_dir/intentfile.json"
+runtool emit "$root/contractiles/must/Mustfile.a2ml" "$out_dir/mustfile.json"
+runtool emit "$root/contractiles/trust/Trustfile.a2ml" "$out_dir/trustfile.json"
+runtool emit "$root/contractiles/dust/Dustfile.a2ml" "$out_dir/dustfile.json"
+runtool emit "$root/contractiles/lust/Intentfile.a2ml" "$out_dir/intentfile.json"
 
 echo "Wrote: $out_dir/mustfile.json"
 echo "Wrote: $out_dir/trustfile.json"

a2ml/scripts/contractiles-a2ml-test.sh

@@ -3,20 +3,22 @@ set -euo pipefail
 
 root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
 
-tool="$root/scripts/contractiles-a2ml-tool.py"
+tool="$root/scripts/contractiles-a2ml-tool.js"
 fixtures="$root/tests/contractiles/fixtures"
 expected="$root/tests/contractiles/expected"
 
-python3 "$tool" validate \
+runtool() { deno run --quiet --allow-read --allow-write "$tool" "$@"; }
+
+runtool validate \
   "$fixtures/Mustfile.a2ml" \
   "$fixtures/Trustfile.a2ml" \
   "$fixtures/Dustfile.a2ml" \
   "$fixtures/Intentfile.a2ml"
 
-python3 "$tool" emit "$fixtures/Mustfile.a2ml" "$expected/mustfile.json.tmp"
-python3 "$tool" emit "$fixtures/Trustfile.a2ml" "$expected/trustfile.json.tmp"
-python3 "$tool" emit "$fixtures/Dustfile.a2ml" "$expected/dustfile.json.tmp"
-python3 "$tool" emit "$fixtures/Intentfile.a2ml" "$expected/intentfile.json.tmp"
+runtool emit "$fixtures/Mustfile.a2ml" "$expected/mustfile.json.tmp"
+runtool emit "$fixtures/Trustfile.a2ml" "$expected/trustfile.json.tmp"
+runtool emit "$fixtures/Dustfile.a2ml" "$expected/dustfile.json.tmp"
+runtool emit "$fixtures/Intentfile.a2ml" "$expected/intentfile.json.tmp"
 
 diff -u "$expected/mustfile.json" "$expected/mustfile.json.tmp"
 diff -u "$expected/trustfile.json" "$expected/trustfile.json.tmp"
@@ -25,7 +27,7 @@ diff -u "$expected/intentfile.json" "$expected/intentfile.json.tmp"
 
 expect_fail() {
   local file="$1"
-  if python3 "$tool" validate "$file"; then
+  if runtool validate "$file"; then
     echo "Expected validation failure: $file" >&2
     exit 1
   fi
@@ -34,7 +36,7 @@ expect_fail() {
 expect_fail_type() {
   local file="$1"
   local type="$2"
-  if python3 "$tool" validate --type "$type" "$file"; then
+  if runtool validate --type "$type" "$file"; then
     echo "Expected validation failure: $file ($type)" >&2
     exit 1
   fi