fix(nextgen-evangelist): least-privilege deno perms + drop generated sample.js

Address #533 review findings:
- Hypatia js_deno_all_perms (CWE-250): the orchestrator spawned sub-tools with
  `deno run -A` (all perms). Replaced with --allow-read --allow-run --allow-write
  (the union the tools need); usage docs updated to --allow-read --allow-run.
- Semgrep detect-non-literal-regexp on deno-esm-spike/sample.js: that file is
  GENERATED --deno-esm output whose prelude uses new RegExp(<non-literal>).
  Generated code is not hand-edited; dropped sample.js + gitignored it, documented
  regeneration, and recorded the prelude-RegExp as a codegen finding.

Orchestrator re-verified green end-to-end with the new flags.

https://claude.ai/code/session_01WoKhFQePiRsAj7aqnxbG8s

Author: claude

proposals/nextgen-evangelist/README.adoc

@@ -88,7 +88,7 @@ guide-linked readiness report
 
 == Verified end-to-end (the orchestrator output)
 
-`deno run -A evangelist/evangelist.mjs /tmp/evangelist-demo manifest.json`
+`deno run --allow-read --allow-run evangelist/evangelist.mjs /tmp/evangelist-demo manifest.json`
 (demo target = the three idaptik kernels + `SecurityRank.affine` +
 `Kernel_IO.affine`) produced:
 

proposals/nextgen-evangelist/deno-esm-spike/.gitignore

@@ -0,0 +1,4 @@
+# Generated AffineScript -> Deno-ESM output (regenerate via README Step 1).
+# Not committed: compiler output; its prelude tripped a Semgrep non-literal-RegExp
+# (ReDoS) finding -- a codegen concern, not source.
+sample.js

proposals/nextgen-evangelist/deno-esm-spike/README.adoc

@@ -34,7 +34,7 @@ This spike is the minimal end-to-end demonstration of that path.
 [cols="1,3"]
 |===
 | `sample.affine` | Minimal AffineScript: two `pub fn`s (`add`, `clamp_band`), pure integer arithmetic, no `extern`/host calls — so the only thing under test is the *export shape*.
-| `sample.js`     | Generated by the compiler with `--deno-esm`. A drop-in ES module (committed here as the captured trial artefact).
+| `sample.js`     | Generated by `--deno-esm` (Step 1). *Not committed* (gitignored): it is compiler output, and its prelude tripped a Semgrep non-literal-RegExp finding. Regenerate it before running the driver.
 | `driver.mjs`    | Plain-JavaScript (`.mjs`, NOT TypeScript) Deno consumer: `import { add, clamp_band } from "./sample.js"` then asserts five results.
 |===
 
@@ -116,6 +116,8 @@ Observations, honestly:
 
 [source]
 ----
+$ # sample.js is gitignored compiler output -- regenerate it first (Step 1):
+$ /home/user/affinescript/_build/default/bin/main.exe compile --deno-esm -o sample.js sample.affine
 $ deno run ./driver.mjs
 deno-esm-spike driver: importing AffineScript-compiled ESM
   typeof add        = function
@@ -159,3 +161,8 @@ the estate "no new TypeScript" policy end to end.
   and `extern fn` -> host-call lowering are documented by `--help` but NOT
   exercised by this spike — a follow-up spike should confirm those export
   shapes too before the harness migration relies on them.
+. The generated runtime prelude calls `new RegExp(<non-literal>)`, which
+  Semgrep flags as a potential ReDoS (`detect-non-literal-regexp`). Because
+  this is *generated* code, the fix belongs in the AffineScript codegen
+  (hardcode the prelude's regexes, or omit the unused shim) — which is also
+  why `sample.js` is gitignored here rather than committed.