Apply GH-DEC-2026-017: INTENT.md governs, the sidecar is derived, no version

- Remove standard_version from layer.yaml and INTENT.md frontmatter (§5, A12).
- Mark layer.yaml derived: true, derived_from: INTENT.md (§1, A11).
- Checker and tests change in the same commit: standard_version is no longer
  a required key (it is now rejected in either form), the derived marking is
  required, both layer values are checked against the closed four-token
  vocabulary, and the two forms are compared after an ASCII case fold (A9).
  A disagreement surviving the fold is reported as a finding.
- Nothing re-spelled: INTENT.md keeps "Engine", layer.yaml keeps "engine".

Scope check (§9.5 / GH-DEC-2026-017 §4): maturity-engine does not score
layer declarations anywhere. scoring.py grades gap-register conformance
states, and seed gaps concern capabilities, not §11 declarations, so no
non-§4 repository is graded. No scoring change required.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

layer.yaml

@@ -1,7 +1,10 @@
 # maturity-engine — NetKingdom security layer declaration
 #
 # Framework: net-kingdom/canon/standards/security-layer-model_v0.7.md
-# Assent:    INTENT.md frontmatter (this repository's own voice, §11)
+# Governs:   INTENT.md frontmatter (this repository's own voice, §11). This
+#            file is a DERIVED artifact of it and does not govern
+#            (GH-DEC-2026-017 §1). No standard version: a layer declaration
+#            MUST NOT carry one (GH-DEC-2026-017 §5).
 # Validate:  python3 scripts/check_layer_conformance.py
 #
 # §11 requires a machine-readable declaration: prose cannot distinguish a
@@ -14,12 +17,13 @@
 
 schema_version: "0.1"
 framework: netkingdom-security-layer-model
-standard_version: "0.7"
 repository: maturity-engine
 layer: engine
 role: pip
 declared_by: INTENT.md
 declared_at: "2026-08-29"
+derived: true
+derived_from: INTENT.md
 
 # §4 catalog entry, transcribed so drift between the catalog and this file is
 # visible. The standard is authoritative for the row; this records what we