CI: six checks red on main (validate/deno, K9, gitleaks .adoc, rust-ci, governance linter, estate-audit)

[hyperpolymath]

Problem

Six checks fail on main (964f956) and on every PR. Each has its own cause, and none comes from a PR's code:

Check	Cause (from the job log)
Build Validation / validate	deno task couldn't find deno.json(c) or package.json. The estate runtime is now bun, so this step targets a runtime that is no longer used.
Dogfood Gate / Validate K9 contracts	Missing K9! magic number / Missing pedigree block on several K9 files. This may be related to #68.
Secret Scanner / scan / gitleaks	2 secret(s) detected in AsciiDoc files, including docs/api-reference.adoc.
Rust CI / rust-ci / Cargo check + clippy + fmt	exit 101
Governance / governance / Workflow security linter	workflow parser gate not found in the pinned Standards revision or locally / duplicate-key checker not found
Central Estate CI/CD Audit / estate-audit	required-file / owner / stub / template-placeholder audit fails

main is also red on E2E + Crosscutting + Bench (E2E, Aspect, Rust Backend), Hypatia and two mirrors.

Acceptance criteria

• validate either runs under bun or is removed. A deno invocation does not count.
• Every K9 file passes Validate K9 contracts: it starts with the K9! magic and has a pedigree block. Cross-reference K9 coordination generator generate.js referenced in AGENTS/GEMINI/.junie headers but missing from repo #68.
• Each gitleaks AsciiDoc finding is triaged in the fixing PR. A real secret is rotated and removed. A false positive is allowlisted by an exact fingerprint, not by a path glob.
• Cargo check + clippy + fmt passes on main, and the fixing PR names the failing step.
• The Governance linter finds its parser and duplicate-key checker at the pinned Standards revision.
• estate-audit is green on main.
• Each item is proven on a real main head SHA, with the conclusion success, not skipped.

Found while landing #136. #136 inherits these reds and does not cause them.