Adopt the canonical package shape policy [skip ci]

Author: swift-institute-bot[bot]

.github/dependabot.yml

@@ -1,93 +1,27 @@
-# ========== CANONICAL (auto-synced, do not edit) ==========
-# This file is generated - do not edit by hand.
+# Generated by instituteci. Do not edit.
+# Canonical Swift package shape policy: 4 (absolute allowlist)
 
-*~
-.DS_Store
-
-Package.resolved
-DerivedData/
-Thumbs.db
-
-# Top-level entries (opt-in only)
-# First ignore everything at root; then whitelist specific folders,
-# files, and dotfiles. Whitelists come AFTER /* so they take effect.
 /*
-!/Sources/
-!/Tests/
-!/Benchmarks/
-!/Experiments/
-!/Research/
-!/Skills/
-!/Scripts/
-!/.github/
+!/.github
+!/Sources
+!/Tests
 !/Package.swift
-!/Package@swift-*.swift
-!/Lint.swift
-!/Lint/
-!/LICENSE
+!/.spi.yml
 !/LICENSE.md
 !/README.md
 !/.gitignore
-!/.spi.yml
-!/.swift-format
-!/.swiftformat
-!/.swiftlint.yml
-!/.swiftlint/
-
-# Documentation (opt-in for whitelisted .md files and .docc catalogs only)
-# Blocks all .md files by default to prevent AI-generated content from being committed
-*.md
-!README.md
-!LICENSE
-!LICENSE.md
-!CHANGELOG.md
-!CONTRIBUTING.md
-!CODE_OF_CONDUCT.md
-!SECURITY.md
-!CLAUDE.md
-!**/*.docc/**/*.md
-!**/Research/**/*.md
-!**/Experiments/**/*.md
-!**/Skills/**/*.md
-!**/.github/**/*.md
-
-# Package insights are non-normative working logs accumulating through
-# reflections-processing. They stay on disk for the author but do not ship.
-**/_Package-Insights.md
-
-# Research working-artifact prevention: underscore-prefixed and prompt dirs
-# are non-canonical and must not ship. _archived/ is the one allowed
-# exception (holds SUPERSEDED research per [META-005]).
-/Research/_*/
-!/Research/_archived/
-/Research/prompts/
-
-*.pdf
-
-# SwiftLint
-**/.swiftlint/RemoteConfigCache
-
-# Swift Package Manager
-.build/
-.swiftpm/
-.benchmarks/
-
-# DocC build artifacts (generated by docc convert/preview)
-.docc-build/
-
-# Tool state: dot-directories are denied at EVERY depth, not just the root.
-# The /* whitelist above only reaches depth 1, so a tool that writes into a
-# whitelisted directory — Sources/.swift-lint/, Tests/.cache/ — was tracked by
-# default. Every tool-state directory in this ecosystem is a dot-directory and
-# no legitimate work ever is, which makes this the one nested deny that costs
-# nothing: whitelisting by extension instead would silently untrack test
-# fixtures and .docc assets, and silent untracking is how work gets lost.
-# /.github is the sole legitimate dot-directory and is re-included after.
-**/.*/
-!/.github/
-
-# ========== END CANONICAL ==========
-
-# ========== LOCAL OVERRIDES ==========
-# Package-specific rules below (managed by sync-gitignore.sh)
 
+/.github/*
+!/.github/workflows
+!/.github/metadata.yaml
+!/.github/FUNDING.yml
+/.github/workflows/*
+!/.github/workflows/ci.yml
+
+/Sources/**
+!/Sources/**/
+!/Sources/**/*.swift
+!/Sources/**/*.docc/**
+/Tests/**
+!/Tests/**/
+!/Tests/**/*.swift