feat(spec): executable cut-criteria with computed status

[trilamsr]

Summary

Replace the hand-edited status glyphs in docs/v1-rc1-cut-criteria.md
with an executable spec at docs/cut-criteria.yaml. Status is now
computed from rubric-check shell + artifact existence; the markdown
is regenerated via make cut-criteria-render and protected by a drift
gate (make cut-criteria-check) wired into CI.

The per-PR ☐ → ⧗ → ☑ flip dance against this markdown is gone. A PR
that ships a criterion's artifact automatically flips its status on the
next render; CI fails any PR that lands a feature without re-rendering.

Why now

The previous shape had a predictable drift pattern. A criterion's
artifact would land but the cut-criteria flip would not, or vice versa.
Reviewers asked "is criterion N actually shipped?" and the only answer
was "look at the docs and the code and hope they agree." This PR is the
inversion: store rubric checks (machine-readable), compute status
(deterministic), render markdown (one direction only, gated).

A concrete drift the new system catches at render time: criterion 1
(pattern coverage ≥ 12 of 15) was marked ⧗ — 8 patterns shipped on
main, but the disk had 12 detector files under module/pkg/patterns/.
The first render flips it to ☑ shipped, exactly as the system
intends.

Inspirations

• Kubernetes KEPs — machine-readable frontmatter (status: implementable | implemented | deferred); the markdown body is
  human-facing, the frontmatter is source-of-truth.
• Bazel bazel run //docs:gen-status — generated documentation
  from in-tree truth, with a CI drift check on the rendered output.
  Operators edit the BUILD inputs, never the rendered output.

What landed

File	Role
docs/cut-criteria.yaml	Source of truth. 12 tier-1 + 3 tier-2 items. Each carries id, title, tier, owner, rubric, citation, rubric_check.{artifact_exists,gate_script}, notes.
docs/cut-criteria.yaml.md	Pattern overview (KEP/Bazel inspirations, schema, workflow, "when to edit which file").
scripts/cut-criteria-status.sh	Computes id\tstatus\ttitle per criterion against live repo state.
scripts/cut-criteria-status_test.sh	Six-fixture regression suite covering all three rubric-check outcome shapes.
scripts/cut-criteria-render.sh	Regenerates docs/v1-rc1-cut-criteria.md from spec + status.
docs/v1-rc1-cut-criteria.md	Now auto-generated (banner at top).
Makefile	New targets: cut-criteria-status, cut-criteria-render, cut-criteria-check. Wired into doc-check.
.github/workflows/ci.yml	Named cut-criteria-check step under verify-static for legibility (transitive via doc-check too).

Status decision table

artifact_exists	gate_script	computed status
pass	pass / empty / absent	☑ shipped
pass	fail	⧗ in progress
fail	any	☐ planned

gate_script is the lever for criteria where the artifact exists but
isn't yet production-grade. Criterion 3 (attribute namespace
hard-locked) is the canonical example: the check script exists today
but runs in advisory mode, so artifact_exists passes and
gate_script (grep for the "advisory only" exit-0 short-circuit) fails
→ status is ⧗ until the gate is promoted to required.

Computed status as of this PR

1  ☑ shipped       Pattern coverage ≥ 12 of 15        (drift fix: doc said ⧗/8)
2  ☑ shipped       Verdict schema v1.0 published and stable
3  ⧗ in progress   Attribute namespace hard-locked    (gate: advisory)
4  ☑ shipped       Deprecation policy + enforcement gate
5  ☑ shipped       Support matrix published
6  ☑ shipped       Compat CI matrix green
7  ⧗ in progress   SLO targets binding                (gate: soft commitment)
8  ☑ shipped       Threat model published
9  ☐ planned       Reference architectures × 3
10 ☐ planned       Production-preset Helm values
11 ☑ shipped       v0.x → v1.0 upgrade guide
12 ☑ shipped       Verdict-consumption SDKs (Python + Go)
A  ☑ shipped       Audit RFP filed
B  ☐ planned       Partner outreach checkpoint
C  ☐ planned       Launch artifacts drafted

Test plan

• bash scripts/cut-criteria-status_test.sh — 6/6 fixture cases
  pass (TDD: RED commit precedes GREEN).
• bash scripts/cut-criteria-status.sh against the live repo
  matches the computed-status snapshot above.
• make cut-criteria-render produces a stable rendered markdown
  (idempotent — two consecutive renders → no diff).
• make cut-criteria-check exits clean on this branch.
• make doc-check exits clean (transitively includes
  cut-criteria-check).
• make actionlint clean on the new ci.yml step.
• shellcheck clean on the three new shell scripts.
• make check (lint/vet/tidy/mod-verify) clean.

Drift gate semantics

make cut-criteria-check renders to a tempfile and diffs against the
on-disk docs/v1-rc1-cut-criteria.md. Two failure paths it catches:

1. YAML edited without re-rendering → markdown stale → diff non-empty.
2. Repo state changed (artifact landed/removed) without re-rendering →
   computed status changed → diff non-empty.

Either way, the PR fails CI until the author re-runs make cut-criteria-render and commits.

- Cut-criteria status (`docs/v1-rc1-cut-criteria.md`) is now generated
  from `docs/cut-criteria.yaml`. Edit the YAML and run
  `make cut-criteria-render`; CI's new `cut-criteria-check` step fails
  any PR that lands a feature without re-rendering. Pattern overview at
  `docs/cut-criteria.yaml.md`.

[trilamsr]

Addressed reviewer high-leverage findings:

Fixed:

• cut-criteria-status.sh b64 decode now fails loudly w/ criterion id (was silent → ☐ planned masking real corruption).
• Criterion 2 (verdict schema) gate now wires the Go drift test (was empty — rubric claimed drift-check but none ran).
• Criterion 8 (threat-model) gate adds STRIDE keyword content check (was file-existence only — empty file flipped ☑).
• Removed double-call from ci.yml verify-static step; cut-criteria-check only runs via make doc-check aggregator now.

Resolved DIRTY conflict by re-rendering docs/v1-rc1-cut-criteria.md from docs/cut-criteria.yaml (which is now the source of truth — proving the system works).

Acknowledged (future hardening):

• Criterion 1 regex brittleness, criterion 3 advisory-only grep, render-script-as-heredoc refactor — future tightening, not blocking rc1.