[gates] src/**/*.rs is root-anchored; cargo workspaces can never satisfy it #1228

Observed from hyperpolymath/oikos-economics-accounting-dsl (its audit docs/tech-debt-2026-10-10.adoc §7 item 2), against this repo at 3108c1b.

template-capability-gates.toml [gates]:

"src/**/*.rs" = "rust"

The glob is anchored at the repository root. A cargo workspace keeps sources in <crate>/src/**/*.rs and has no root src/, so declaring rust posts a permanent MISSING. Exact output against oikos (four crates, 20+ .rs files under oikos-*/src/):

$ bash /tmp/standards/scripts/check-rsr-profile.sh .
repo:    .
profile: direct-capabilities
effective capabilities: docs-site governance-tier rust

  MISSING (rust): src/**/*.rs
  MISSING (rust): .github/workflows/rust-ci.yml
  MISSING (governance-tier): docs/AUDIT.adoc|AUDIT.adoc

rsr-profile check: FAIL — scaffold does not match declared capabilities.

Both local "fixes" are wrong: a vestigial empty root src/ (the exact vestigial-scaffold outcome the capability model exists to prevent), or not declaring rust (which also drops Cargo.toml/Cargo.lock from the gate table).

Ask: "src/**/*.rs|*/src/**/*.rs" = "rust" — the same | alternation the SECURITY.md|.github/SECURITY.md rows use. While here: .github/workflows/rust-ci.yml is the template module name and posts the same class of permanent MISSING for any repo whose Rust CI is ci.yml; an alternation there too would close oikos' last two rust rows.