fix(rhodibot): stop demanding filenames the estate abandoned

[hyperpolymath]

The RSR required-file table predated the Markdown/TXT → AsciiDoc migration
(#486, 2026-08), so rhodibot was demanding filenames the estate had
deliberately moved away from. Measured against 269 estate repositories:

Demanded	Repos that have it	What they actually have
LICENSE.txt	0/269	LICENSE 269/269
CONTRIBUTING.md	25/269	CONTRIBUTING.adoc 255
CODE_OF_CONDUCT.md	15/269	CODE_OF_CONDUCT.adoc 240
SECURITY.md	35/269	SECURITY.adoc 250
lowercase justfile	7/269	Justfile 267
.machine_readable/STATE.scm	1/269	.a2ml spelling 13

A bot whose stated job is "structural checks, directory layout" was telling
essentially every repository to reintroduce the pre-migration filenames —
i.e. to undo the AsciiDoc migration.

What changed

Required files now name the current convention, with the superseded spellings
accepted as alternates, so a completed rename is never reported as a
regression. CheckDef gains alternates, and check_path_exists() tries the
canonical path first and only falls back, so the common case still costs one
request.

Adds RSR-016 (www/.well-known/security.txt, canonical since #53) and
RSR-017 (legacy root .well-known/, remediation "move, do not delete"). Both
advisory at minimal/standard while the stage-5 migration window is open.

Rule IDs RSR-002…RSR-015 are unchanged and still resolve from the old
spellings, so existing reports and .rsr.toml overrides keep working.

Two defects found while in here, both fixed

1. is_fixable() advertised four auto-fixes with no template behind them.
   It listed 7 files; robot-repo-automaton ships 3 templates, and
   get_template_content() falls through to String::new() for anything it
   does not recognise — so it would open PRs creating .gitattributes,
   .gitignore, .claude/CLAUDE.md and .machine_readable/bot_directives
   empty. inbox-steward.yml auto-merges PRs that pass CI. Narrowed to the
   three that have templates.
2. No SECURITY.adoc arm in get_template_content(), so the renamed check
   would also have produced an empty file. Added, sharing SECURITY.tmpl.

Tests

• rhodibot 50 passed / 0 failed (was 45 passing / 3 failing). The 3
  failures were the tests asserting the stale filenames — the stale contract
  written down in code — brought to the current canon. Two regression tests
  added: superseded spellings still pass, and the www/ check is present and
  honestly fails when absent.
• robot-repo-automaton 114 passed / 0 failed.

Caveat on deployment

This PR does not by itself change what the deployed bot does.
deploy-bot-fleet.k9.ncl sets rhodibot.enabled = true and points at
.github/workflows/rhodibot.yml, which does not exist in this repo — the live
instance is most likely a service under deploy/systemd/. Someone with host
access needs to confirm where it runs.

Root cause, not addressed

standards has zero references to rhodibot; its rules are hardcoded in Rust,
which is how they went seven months stale. The durable fix is to make the
required-file table data with standards as the source of truth. Worth doing
as a follow-up.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 65085ff7-0b93-47dd-88b1-e23551f134ec

📥 Commits

Reviewing files that changed from the base of the PR and between e3ea5aa and a813351.

📒 Files selected for processing (5)

• bots/rhodibot/src/fleet.rs
• bots/rhodibot/src/rsr.rs
• bots/rhodibot/src/webhook.rs
• bots/rhodibot/tests/integration_tests.rs
• robot-repo-automaton/src/fixer.rs

 ____________________________________________
< Like a moth to a flame, I'm drawn to bugs. >
 --------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• 🔴 Error committing to branch - (🔄 Check to retry)
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

❌ Failed to create Coding Agent finishing-touch task. Please try again.

[coderabbitai]

❌ Failed to create Coding Agent finishing-touch task. Please try again.