Start CUST-WP-0050: T01 allowed-values + validator; classify the-custodian

Activate the workplan and complete T01: add the machine-readable controlled
vocabulary canon/standards/repo-classification.allowed.yaml (categories,
domains, business_stake, business_mechanics, capability families, guidance),
reference it from the standard §12, and add tools/validate_repo_classification.py
(stdlib + PyYAML, --self-test PASS).

Begin T02: author the-custodian/.repo-classification.yaml (research · infotech ·
agents), which validates clean. classified_by: agent, pending human review.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

canon/standards/repo-classification.allowed.yaml

@@ -0,0 +1,111 @@
+# Machine-readable allowed-values for the Repo Classification Standard.
+#
+# Single source of truth for the standard's controlled vocabularies, derived
+# from canon/standards/repo-classification-standard_v1.0.md. Consumed by:
+#   - the per-repo .repo-classification.yaml linter (tools/validate_repo_classification.py)
+#   - the State Hub registration validator (CUST-WP-0050 T04)
+#
+# When the standard's vocabularies change, update this file and bump `version`
+# to match the standard version. CUST-WP-0050 T01.
+
+standard: "Repo Classification Standard"
+version: "1.0"
+canon_id: "canon-repo-classification"
+
+# category — exactly 1 required (§5)
+categories:
+  - experimental
+  - research
+  - project
+  - product
+  - business
+
+# domain / secondary_domains — primary exactly 1; secondaries 0..n (§6)
+domains:
+  - infotech
+  - financials
+  - communication
+  - consumer
+  - health
+  - industrials
+  - energy
+  - utilities
+  - materials
+  - realestate
+  - crypto
+  - agents
+  - space
+  - government
+
+# business_stake — 0..n; 2..6 recommended (§8)
+business_stake:
+  - execution
+  - intelligence
+  - finance
+  - legal
+  - sales
+  - experience
+  - technology
+  - operations
+  - product
+  - people
+  - procurement
+  - sustainability
+  - automation
+
+# business_mechanics — 0..n, optional (§9)
+business_mechanics:
+  - intention
+  - control
+  - coordination
+  - operation
+  - adaptation
+
+# capability_tags are intentionally OPEN-ENDED (§7): lowercase kebab-case, not
+# restricted to this set. The families below are the standard's recommended
+# canonical tags — used to warn on likely synonyms/typos, never to reject.
+capability_families:
+  identity_and_access:
+    - identity
+    - authentication
+    - authorization
+    - access-control
+    - user-management
+    - tenancy
+  knowledge_and_evidence:
+    - knowledge
+    - citations
+    - evidence
+    - source-management
+    - traceability
+    - documentation
+  platform_and_operations:
+    - platform
+    - deployment
+    - operations
+    - observability
+    - feature-control
+    - configuration
+    - orchestration
+  market_and_coordination:
+    - marketplace
+    - pricing
+    - reputation
+    - challenges
+    - bounties
+    - collaboration
+    - coordination
+  governance_and_control:
+    - governance
+    - policy
+    - compliance
+    - risk
+    - audit
+    - control
+
+# Validation guidance (advisory bounds the linter applies as warnings)
+guidance:
+  secondary_domains_max: 3
+  business_stake_recommended_min: 2
+  business_stake_recommended_max: 6
+  capability_tag_pattern: "^[a-z0-9]+(-[a-z0-9]+)*$"