chore: establish SpecGit delivery harness

[LeXwDeX]

Closes #17

Why

The repository had no SpecGit policy, so deliveries could not produce an auditable specgit finish verdict even though CI already exposes a stable validation check (Validate DAG templates, canonical job id validate).

What changed

• specgit init --required-check validate --no-protect generated the harness:
  • spec_git/policy.yaml requires the canonical check id validate (the Validate DAG templates job), not its display name.
  • .github/workflows/specgit-accept.yml — SpecGit Acceptance verdict workflow (new file; the existing validate.yml is untouched).
  • AGENTS.md harness block, .opencode/hooks.json + merge-guard hook, .gitignore block for local delivery assets, and the delivery binding .specgit.yaml.
• Rebound the delivery to this chore/17-specgit-harness branch via specgit bind; draft PR Delivery specgit-harness #20 (feat-prefixed head) was closed unused.
• script/validate-route-catalog.ts: the catalog inventory now scans visible files only — hidden delivery dotfiles (.specgit.yaml) are tooling, not routes. Two tests added: dotfile tolerance, and continued rejection of visible out-of-catalog YAML. No route template, runtime-compat.json, or workflow file changed.

Evidence

• specgit doctor --json exits 0 with a healthy policy requiring validate.
• CI on head aa825cc: validate pass, SpecGit Acceptance pass (in-CI verdict exit 0).
• specgit finish --json exit 0 — state accepted, 11/11 gates pass, no warnings.
• Zero-touch confirmed: git diff main --name-only lists only harness files, policy/record, and the two validator/test files.

Checklist

• Why, What changed, and Evidence are filled in.
• specgit finish exits 0.