[carve-out 3/9] Evict protocol implementations (avow, axel, consent-aware-http, mcp-repo-guardian, repo-guardian-fs); keep spec text

[hyperpolymath]

Child of #479. Three protocol dirs duplicate external home repos their own docs cite as canonical (deploy docs, DNS zone files, CITATIONS.adoc) while the registry claims the in-standards copy is home — the registry's own logic says duplicating normative text guarantees drift.

• avow-protocol/ → hyperpolymath/avow-protocol (exists). Keep docs/PROTOCOL.adoc + AVOW-THREAT-MODEL.adoc. Moves: website, CNAME, DNS zones, Cloudflare runbooks, telegram-bot, deployment-status session files.
• axel-protocol/ → hyperpolymath/axel-protocol (exists; 50 in-tree references). Keep protocol text, CHARTER.adoc, GOVERNANCE.adoc. Moves: axel-protocol.org site, reference impl, committed compiled .res.js.
• consent-aware-http/ → hyperpolymath/consent-aware-http (exists; also where the prospective PMPL licence applies — the standards copy's licence status is ambiguous, which this eviction resolves). Keep the IETF I-D XML + schemas. Moves: src/*.affine, ffi/zig/, reference implementations, Justfile, assets. Licence-adjacent: flag-only; no SPDX edits during the move.
• 0-ai-gatekeeper-protocol/mcp-repo-guardian/ → hyperpolymath/mcp-repo-guardian (exists — npm-published server with its own release lifecycle). repo-guardian-fs/ (+ stray top-level ffi/zig/) → own repo (carries full standalone-repo scaffolding — the exact anti-pattern gitbot-fleet bans for bot slots).

Alternative per directory: convert the registry entry to kind = "external" with canonical_url + recorded hash (the AffineScript pattern) instead of keeping partial local text — decide per protocol at PR time. Registry regen + --check in every PR.