chore: reconcile Bootstrap manifest contract

[jmcte]

Summary

• Reconcile the project manifest with the current Bootstrap schema and safety contract.
• Declare the repository's CodeQL language/build targets, canonical class migration, or managed-path dependencies as applicable.

Governing Issue

No governing issue is linked; this is a scheduled Bootstrap fleet reconciliation.

Validation

• The repaired Bootstrap control plane produced a plan for this manifest without schema or ownership-validation errors.
• The change is limited to project.bootstrap.yaml.

Bootstrap Governance

• No real secrets, runtime auth, or machine-local environment files are committed.
• Existing local worktrees were preserved; this PR was created from refreshed origin/main.

Merge Automation

Auto-merge is not available until a maintainer reviews and enables it for this scheduled reconciliation PR; fallback merge-readiness applies.

Notes

• This PR is intentionally manifest-only. Bootstrap-managed generated files should be applied only after this manifest contract is reviewed and merged.

[athena-omt]

Request changes: ci.codeqlLanguages: [python] cannot establish the declared CodeQL baseline while repo.managedPaths excludes .github/workflows/security.yml. I ran the current Bootstrap plan against this exact PR head; it accepts the manifest but does not plan security.yml, so a later bootstrap apply repo cannot create or update the managed CodeQL workflow. Add .github/workflows/security.yml to repo.managedPaths and verify the generated security workflow/plan against the same manifest before re-requesting review. The PR’s existing CI checks are successful, but they do not cover this projected-workflow gap.