Harden the model after 1.0.0 #664

What this collects

The gaps in the model and the tooling found while building 1.0.0 that no Project's handover waits on: refusals the model owes, identities and names it leaves unconstrained, grants broader than they need be, and CI hygiene. Each sub-issue stands on its own; none blocks Rewrite the spec and the compiler in place, release 1.0.0, and hand over every Project.

Order

Correctness first (a refusal the model owes, a name it should constrain), then least privilege, then tooling.