feat: export guidelines - the guideline pages as a generated GUIDELINES.md, pushed into the captured repositories behind the Guideline Push Gate (#179)

Files changed:
- AGENTS.md
- CHANGES.md
- README.md
- VERSION
- docs/why-gates-are-code.md
- instructions/gates.md
- instructions/kb-profiles.md
- kb/CONTRACT.md
- kb/CONVENTIONS.md
- kb/CONVENTIONS.md.template
- raw/CONTRACT.md
- tools/CONTRACT.md
- tools/README.md
- tools/chemenu/cli.py
- tools/chemenu/cli_contract.py
- tools/chemenu/commands/export_cmd.py
- tools/chemenu/commands/page_ops.py
- tools/chemenu/commands/raw_cmd.py
- tools/chemenu/commands/search.py
- tools/chemenu/guideline_export.py
- tools/chemenu/kb_scan.py
- tools/chemenu/repo_capture.py
- tools/chemenu/search/filters.py
- tools/chemenu/tests/test_cli.py
- tools/chemenu/tests/test_export_guidelines.py

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SnAJ7Z3CpVD3PRbN73QtU2

raw/CONTRACT.md

@@ -94,6 +94,14 @@ That is what keeps the clean-up safe: only directories the moves emptied are rem
 can go with them. A file *inside* a subdirectory is never accepted on its own; the refusal names
 both ways out - the whole folder, or the file moved up into `incoming/`.
 
+**A guideline export never comes back in.** A file whose first line (after an optional BOM)
+starts with `<!-- wikitool:export` is this stack's own output - `export guidelines` renders the
+wiki's guideline pages into it for other repositories - and `raw accept` refuses it, given on its
+own, inside a folder, or as `--replaces`/`--replaces-bundle` material, naming each one. Taken in,
+it would turn the wiki's knowledge on its way out into a source the wiki then cites for the same
+claims. `raw capture` leaves such a file out of a repository for the same reason
+([below](#getting-a-repository-in-raw-capture)).
+
 A subdirectory used to be tolerated and ignored, for the old `incoming/<type>/` habit. It carries
 no type any more - the kind of source comes from its content, as `source_type:` on the source
 page (§ Directory routing above) - so the tolerance protected nothing, and a folder that belongs
@@ -276,9 +284,13 @@ names it by its path inside the bundle (`docs/runbook.md`), not by its base name
 **`_capture.json` is the bundle's manifest** - `repo`, the `ref` rule, the `commit`, the `paths`
 globs, when it was `captured`, `fidelity`, `authority` and the `files` list. It is the only
 declaration that and how this instance follows the repository; there is no second configuration
-file. The name is reserved: it is metadata of the bundle, not a source, so `sources coverage` and
-`lint` never report it, no `raw_files:` lists it, and no file of that name is captured from a
-repository or accepted from `incoming/` anywhere but at the top of a captured folder.
+file. It is read in the other direction too: the captured repositories are exactly the ones
+`export guidelines --push` writes this instance's `GUIDELINES.md` into - each one that opted in
+by carrying the file, on the branch its ref rule names (a tag rule takes no commit, so such a
+repository is skipped). The name is reserved: it is metadata of the bundle, not a source, so
+`sources coverage` and `lint` never report it, no `raw_files:` lists it, and no file of that name
+is captured from a repository or accepted from `incoming/` anywhere but at the top of a captured
+folder.
 
 **Some files are never captured, by mechanism, each named in the output:** a file whose first line
 starts with `<!-- wikitool:export` (this stack's own guideline export - the wiki's knowledge on its