Third PR in the 12-PR file-policy rollout decomposition. Populates the
high-risk ledgers that #214 left as scaffolds. No checker, no
enforcement, no CI wiring.

## workflow-allowlist.toml

Explicit receipt for every workflow currently in `.github/workflows/`.
No `.github/**` wildcard. Each entry declares its `process_policy` and
`network_policy`:

  ci.yml, coverage.yml, architecture-guard.yml,
  fuzz.yml, mutation.yml         → ci profile
  release.yml                    → release profile
  droid-review.yml, droid.yml,
  droid-security-scan.yml        → droid profile

Also receipts `.github/dependabot.yml` (configuration, not a workflow,
but governs bot behavior).

## process-allowlist.toml

Three named profiles seeded with the commands actually invoked today:

  ci      → cargo, rustup, rustc, cargo-fuzz, cargo-mutants,
            cargo-llvm-cov, cargo-nextest
  release → adds shipper, gh, tar, sha256sum, install, sudo
  droid   → bash, curl, sh, bun, mkdir, cat, jq
            (Factory CLI fetch + BYOK heredoc + droid-action-safe)

## network-allowlist.toml

Three named profiles seeded with endpoints actually contacted today:

  ci      → github.com + crates.io family, rustup endpoints, codecov
  release → adds Trusted Publishing OIDC + uploads.github.com
  droid   → adds app.factory.ai, api.factory.ai, api.minimax.io

Renames the array-of-tables from `[[policy]]` to `[[profile]]` to
avoid collision with the top-level `policy = "..."` field. All eight
ledgers now parse as valid TOML.

Acceptance: every `policy/*.toml` parses; `cargo check --workspace
--locked` passes. PR 8 (#207) adds the checker that scans workflows
and reconciles against these profiles.

Closes #203.

Sixth PR in the 12-PR file-policy rollout. Adds
`cargo xtask non-rust propose`, which finds tracked non-Rust files
that are not yet covered by `policy/non-rust-allowlist.toml` and
writes draft entries to `target/policy/`:

  target/policy/non-rust-proposed-allowlist.toml
  target/policy/non-rust-proposal.md

The proposer NEVER mutates `policy/non-rust-allowlist.toml`. The
draft TOML is a starting point; a human (or follow-up agent) reviews,
edits, and intentionally copies entries into the real ledger.

## Behavior

- Walks `git ls-files -z` minus `*.rs` for the tracked non-Rust set.
- Loads `policy/non-rust-allowlist.toml` and the `[[file]]` / `[[glob]]`
  selectors.
- Subtracts the covered set; the remainder is the unreceipted list.
- Writes one `[[file]]` entry per unreceipted path with TODO fields:

      kind = "TODO"
      surface = "TODO"
      classification = "TODO"
      owner = "TODO"
      reason = "TODO: explain why this non-Rust surface remains. If
                scheduled for conversion to Rust/xtask, say so and add
                an `expires` date."
      created = "<today>"
      review_after = "<today + 90 days>"

- Writes a Markdown proposal that groups entries by top-level directory
  and explains the review workflow.

## Decisions

- **Default review window: 90 days.** Honest enough for a first-pass
  receipt; a reviewer can shorten or extend per entry. Matches what the
  hand-seeded receipts in #214 used.
- **TOML rendered by hand, not via `toml::to_string`.** Keeps comment
  blocks at the top and the order deterministic. The proposed-allowlist
  schema is documented inline so reviewers see the explanation in the
  file itself.
- **Duplicated allowlist deserialization + tracked-file enumeration
  from check_file_policy.rs.** The shared helpers fit in ~30 lines
  each; a DRY refactor is a small follow-up PR rather than scope creep
  here.

## Acceptance

- `cargo check --workspace --locked` passes.
- `cargo clippy -p xtask --all-targets --locked -- -D warnings` clean.
- `cargo fmt --all -- --check` clean.
- `cargo xtask non-rust propose` ran on this branch:
    `wrote 945 proposed entries to target/policy/non-rust-proposed-
     allowlist.toml (and matching non-rust-proposal.md)`
- Both artifacts produced; the TOML parses as valid TOML.
- `policy/non-rust-allowlist.toml` is unchanged (proposer never
  touches the real ledger).

Closes #205.