Stop drafting agents from following external language-source instructions

[daveh-beep]

Summary

Stop drafting agents from fetching and following instructions from an external
language repository.

A language source is a dependency record—not a grant of agent authority. A
consuming owner or trusted integration now reviews an exact source revision
outside the drafting session, copies only approved declarative language data
into a local snapshot, and accepts that snapshot through ordinary repository
review. Drafting agents read only the reviewed local data.

Why

The former README pattern told a drafting agent to read another repository's
AGENTS.md and follow it.

A synthetic adversarial source combined a legitimate terminology rule with
instructions to read a sentinel and mutate a file. Codex rejected the
operational directive, Claude stopped, and goose rejected the final mutation
but read the sentinel first.

That design was unsafe: prose did not reliably sandbox other prose once both
entered a tool-capable agent context.

Changes

• Add PINNING.md with the reviewed local-snapshot boundary.
• Replace the external language-pin instructions in AGENTS.md.
• Replace the unsafe cross-repository example in README.md.
• Add a public-safe red-team receipt covering the unsafe design, corrected
  local snapshot, and missing-source-record case.
• Add a focused static regression that rejects the old raw-instruction pattern
  and checks the local-snapshot contract.

Contract

1. Drafting agents never fetch, interpret, or follow external instruction
   repositories.
2. A consuming owner or trusted integration reviews the source at an exact
   immutable revision outside the drafting session.
3. Only approved declarative language data enters the repository-local
   snapshot.
4. Drafting agents read only that reviewed local data.
5. Each consuming repository owns updates and recovery.

Evidence and checks

• checks/RED-TEAM-2026-07-30.md records the
  synthetic attack and corrected local-snapshot cases.
• ./checks/adversarial-contract.sh passes.
• git diff --check origin/main...HEAD passes.
• All commits include DCO sign-off.

Non-goals

This PR does not add:

• task-first or agent-routed setup;
• correction-driven learning;
• new calibration semantics;
• a snapshot projector, validator, registry, or service;
• global consumer discovery or revocation;
• organization-wide language governance;
• Builder Lab or Ghost product integration.

Safety

All committed evidence is synthetic and public-safe. This change does not add
secrets, customer data, confidential source material, private links, or
internal product strategy.