Apply GH-DEC-2026-017: INTENT.md governs, layer.yaml is derived, no version

Remove standard_version from layer.yaml and the INTENT.md frontmatter (A12),
mark layer.yaml derived: true / derived_from: INTENT.md (A11), and change the
conformance checker and its tests in the same commit so the conforming
declaration does not fail as malformed.

The checker now requires the INTENT.md layer: key, rejects standard_version
in either form, checks the layer against the closed four-token vocabulary
(A9), and reports a layer/role disagreement between the two forms after an
ASCII case-fold. Nothing is re-spelled: INTENT.md keeps Engine/PIP and
layer.yaml keeps engine/pip. pep-stance.yaml and pip-claims.yaml keep their
standard_version; neither is a layer declaration.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

layer.yaml

@@ -5,6 +5,10 @@
 # Assent:    decisions/decisions.md TEN-DEC-2026-001
 # Validate:  python3 scripts/check_layer_conformance.py
 #
+# Derived artifact (§11, GH-DEC-2026-017 §1): INTENT.md frontmatter governs;
+# this file is its machine-readable form and must agree with it once case is
+# folded. No standard version is carried here (GH-DEC-2026-017, A12).
+#
 # Engine / PIP. Same authoritative tenant state yields the same result. We
 # supply tenant-as-an-entity facts as claims; we do not render a decision.
 # Writes are PEP-shaped (pep-stance.yaml). Catalogued Tooling (§4) is
@@ -12,8 +16,9 @@
 
 schema_version: "0.1"
 framework: netkingdom-security-layer-model
-standard_version: "0.7"
 repository: tenant-engine
+derived: true
+derived_from: INTENT.md
 layer: engine
 role: pip
 declared_by: decisions/decisions.md#TEN-DEC-2026-001