feat(aggregate-library): adopt Overlay Protocol + convert from orphaned gitlink

Convert aggregate-library from orphaned 160000-mode gitlink to regular
tracked directory. Add overlay-protocol section to ECOSYSTEM.scm declaring
it as a conformant overlay (peer-type: aggregate-library, switchable,
non-modifying). Update AI manifest with non-modification invariant.
Add HOL-o-extension as overlay-protocol-peer in related-projects.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: hyperpolymath

aggregate-library

@@ -0,0 +1,9 @@
+;; SPDX-License-Identifier: PMPL-1.0-or-later
+;; .bot_directives — per-bot rules and constraints
+;; Media-Type: application/vnd.bot-directives+scm
+
+(bot-directives
+  (version "1.0")
+  (notes
+    "Repo-specific bot constraints."
+    "Bots must follow these directives in addition to global policies."))

aggregate-library/.bot_directives/README.scm

@@ -0,0 +1,7 @@
+;; SPDX-License-Identifier: PMPL-1.0-or-later
+(bot-directive
+  (bot "echidnabot")
+  (scope "formal verification and fuzzing")
+  (allow ("analysis" "fuzzing" "proof checks"))
+  (deny ("write to core modules" "write to bindings"))
+  (notes "May open findings; code changes require explicit approval"))

aggregate-library/.bot_directives/echidnabot.scm

@@ -0,0 +1,7 @@
+;; SPDX-License-Identifier: PMPL-1.0-or-later
+(bot-directive
+  (bot "finishbot")
+  (scope "release readiness")
+  (allow ("release checklists" "docs updates" "metadata fixes"))
+  (deny ("code changes without approval"))
+  (notes "Focus on polish, licensing, and packaging"))

aggregate-library/.bot_directives/finishbot.scm

@@ -0,0 +1,7 @@
+;; SPDX-License-Identifier: PMPL-1.0-or-later
+(bot-directive
+  (bot "glambot")
+  (scope "presentation + accessibility")
+  (allow ("docs" "readme badges" "ui/accessibility suggestions"))
+  (deny ("logic changes"))
+  (notes "Edits limited to presentation layers"))

aggregate-library/.bot_directives/glambot.scm

@@ -0,0 +1,7 @@
+;; SPDX-License-Identifier: PMPL-1.0-or-later
+(bot-directive
+  (bot "rhodibot")
+  (scope "rsr-compliance")
+  (allow ("metadata" "docs" "repo-structure checks"))
+  (deny ("destructive edits without approval"))
+  (notes "Auto-fix allowed only for formatting in docs and metadata"))

aggregate-library/.bot_directives/rhodibot.scm

@@ -0,0 +1,7 @@
+;; SPDX-License-Identifier: PMPL-1.0-or-later
+(bot-directive
+  (bot "robot-repo-automaton")
+  (scope "automated fixes")
+  (allow ("low-risk automated edits"))
+  (deny ("core logic changes without approval"))
+  (notes "Only apply fixes backed by explicit rule approval"))

aggregate-library/.bot_directives/robot-repo-automaton.scm

@@ -0,0 +1,7 @@
+;; SPDX-License-Identifier: PMPL-1.0-or-later
+(bot-directive
+  (bot "seambot")
+  (scope "integration health")
+  (allow ("analysis" "contract checks" "docs updates"))
+  (deny ("code changes without approval"))
+  (notes "May add integration test suggestions"))

aggregate-library/.bot_directives/seambot.scm

@@ -0,0 +1,7 @@
+;; SPDX-License-Identifier: PMPL-1.0-or-later
+(bot-directive
+  (bot "sustainabot")
+  (scope "eco/economic standards")
+  (allow ("analysis" "reporting" "docs updates"))
+  (deny ("code changes without approval"))
+  (notes "Focus on measurement and recommendations"))

aggregate-library/.bot_directives/sustainabot.scm

@@ -0,0 +1,83 @@
+## Machine-Readable Artefacts
+
+The following files in `.machine_readable/` contain structured project metadata:
+
+- `STATE.scm` - Current project state and progress
+- `META.scm` - Architecture decisions and development practices
+- `ECOSYSTEM.scm` - Position in the ecosystem and related projects
+- `AGENTIC.scm` - AI agent interaction patterns
+- `NEUROSYM.scm` - Neurosymbolic integration config
+- `PLAYBOOK.scm` - Operational runbook
+
+---
+
+# CLAUDE.md - AI Assistant Instructions
+
+## Language Policy (Hyperpolymath Standard)
+
+### ALLOWED Languages & Tools
+
+| Language/Tool | Use Case | Notes |
+|---------------|----------|-------|
+| **ReScript** | Primary application code | Compiles to JS, type-safe |
+| **Deno** | Runtime & package management | Replaces Node/npm/bun |
+| **Rust** | Performance-critical, systems, WASM | Preferred for CLI tools |
+| **Tauri 2.0+** | Mobile apps (iOS/Android) | Rust backend + web UI |
+| **Dioxus** | Mobile apps (native UI) | Pure Rust, React-like |
+| **Gleam** | Backend services | Runs on BEAM or compiles to JS |
+| **Bash/POSIX Shell** | Scripts, automation | Keep minimal |
+| **JavaScript** | Only where ReScript cannot | MCP protocol glue, Deno APIs |
+| **Nickel** | Configuration language | For complex configs |
+| **Guile Scheme** | State/meta files | STATE.scm, META.scm, ECOSYSTEM.scm |
+| **Julia** | Batch scripts, data processing | Per RSR |
+| **OCaml** | AffineScript compiler | Language-specific |
+| **Ada** | Safety-critical systems | Where required |
+
+### BANNED - Do Not Use
+
+| Banned | Replacement |
+|--------|-------------|
+| TypeScript | ReScript |
+| Node.js | Deno |
+| npm | Deno |
+| Bun | Deno |
+| pnpm/yarn | Deno |
+| Go | Rust |
+| Python | Julia/Rust/ReScript |
+| Java/Kotlin | Rust/Tauri/Dioxus |
+| Swift | Tauri/Dioxus |
+| React Native | Tauri/Dioxus |
+| Flutter/Dart | Tauri/Dioxus |
+
+### Mobile Development
+
+**No exceptions for Kotlin/Swift** - use Rust-first approach:
+
+1. **Tauri 2.0+** - Web UI (ReScript) + Rust backend, MIT/Apache-2.0
+2. **Dioxus** - Pure Rust native UI, MIT/Apache-2.0
+
+Both are FOSS with independent governance (no Big Tech).
+
+### Enforcement Rules
+
+1. **No new TypeScript files** - Convert existing TS to ReScript
+2. **No package.json for runtime deps** - Use deno.json imports
+3. **No node_modules in production** - Deno caches deps automatically
+4. **No Go code** - Use Rust instead
+5. **No Python anywhere** - Use Julia for data/batch, Rust for systems, ReScript for apps
+6. **No Kotlin/Swift for mobile** - Use Tauri 2.0+ or Dioxus
+
+### Package Management
+
+- **Primary**: Guix (guix.scm)
+- **Fallback**: Nix (flake.nix)
+- **JS deps**: Deno (deno.json imports)
+
+### Security Requirements
+
+- No MD5/SHA1 for security (use SHA256+)
+- HTTPS only (no HTTP URLs)
+- No hardcoded secrets
+- SHA-pinned dependencies
+- SPDX license headers on all files
+