chore: reconcile Bootstrap manifest contract

[jmcte]

Summary

• Reconcile the project manifest with the current Bootstrap schema and safety contract.
• Declare the repository's CodeQL language/build targets, canonical class migration, or managed-path dependencies as applicable.

Governing Issue

No governing issue is linked; this is a scheduled Bootstrap fleet reconciliation.

Validation

• The repaired Bootstrap control plane produced a plan for this manifest without schema or ownership-validation errors.
• The change is limited to project.bootstrap.yaml.

Bootstrap Governance

• No real secrets, runtime auth, or machine-local environment files are committed.
• Existing local worktrees were preserved; this PR was created from refreshed origin/main.

Merge Automation

Auto-merge is not available until a maintainer reviews and enables it for this scheduled reconciliation PR; fallback merge-readiness applies.

Notes

• This PR is intentionally manifest-only. Bootstrap-managed generated files should be applied only after this manifest contract is reviewed and merged.

[athena-omt]

Infrastructure blocker: I could not complete a substantive review of the current PR head. The Athena node route was initially verified, but the node disconnected while fetching the exact PR head for local source, call-path, and test inspection. Please reconnect the Athena node and rerun the review; no approval is warranted without an exact-head local checkout.

[athena-omt]

Exact-head review: 79ce727. This manifest-only change declares the repository's present JavaScript/TypeScript, Python, Ruby, Rust, and Swift CodeQL languages. I inspected the manifest context and relevant source layout; the declaration is consistent with the repo. The prior Athena comment was an infrastructure-only deferral, now superseded by this substantive review. Checks: Detect Relevant Changes, Rust test, Rust lint, Fast Checks, Validate Secrets, and CI Gate succeeded (native jobs were intentionally skipped because this is manifest-only). Merge-ready from review perspective; residual risk is Bootstrap-control-plane interpretation rather than an application-code change.