policy: bun-first runtime order; name the ban's exemption classes

a2ml-templates/AGENTIC.a2ml.template

@@ -60,7 +60,30 @@ documentation = "inline"
 languages = ["affinescript", "rust", "gleam", "{{PRIMARY_LANGUAGE}}"]
 
 # banned: Languages the agent must NEVER use, even if asked.
-banned = ["typescript", "rescript", "go", "python", "makefile"]
+banned = ["typescript", "rescript", "go", "python", "ruby", "makefile"]
+
+# banned-exempt-repo-classes: the ONLY places a banned language may appear.
+# A ban is about not letting a language spread through the estate — not about
+# pretending it does not exist. Interoperating with an ecosystem means writing
+# in it, in one bounded, named place:
+#   <lang>-ecosystem — the repo that exists to hold that language's world
+#                      (e.g. rescript-ecosystem)
+#   adapter          — a bounded translation layer to a foreign ecosystem
+#                      (e.g. the ReScript adapter in `proven`)
+#   mcp              — an MCP server for one specific external thing
+# Anywhere else, a banned language is a defect regardless of how it got there.
+banned-exempt-repo-classes = ["<lang>-ecosystem", "adapter", "mcp"]
+
+# js-runtime-order: preference for anything needing a JS runtime or package
+# manager. Take the first that can do the job; drop to the next only when it
+# genuinely cannot.
+#   bun  — the default. Compatibility decides, and bun has it.
+#   deno — second. Kept for existing code; not chosen for new work. Walking
+#          everything through Deno was a real cost, and its longevity is not
+#          a safe bet to build on.
+#   pnpm — third, when a real node_modules layout is unavoidable.
+#   npm  — last resort only.
+js-runtime-order = ["bun", "deno", "pnpm", "npm"]
 
 # ── Project-Specific Overrides ────────────────────────────────────────────
 [agentic-config.project-specific]