Spec: enforce reverse coverage + staleness, and sync .specsync registry

[0xLeif]

Three spec-tooling gaps:

• Spec validation is structural-only — a fully stale spec passes both the local check and CI strict mode (see the review/ask/doctor drift fixed in Update: correct stale Claude-CLI references in review/ask/doctor specs (H-5) #438).
• 660 lines (src/utils.rs, src/meta.rs) are claimed by no spec, and nothing checks reverse coverage (prod code → owning spec).
• Committed .specsync/registry.toml is stale: 6 entries point at deleted specs and 7 live specs are unregistered.

---

Filed from a skeptical staff-level review (Medium-severity tier). All Critical/High findings and the correctness/doc Medium findings were fixed in #432–442.

[0xLeif]

Partially addressed by #462, which shipped the registry-sync subset (.specsync/registry.toml now 1:1 with the 30 live specs, sorted alphabetically). Reopening to track the remaining scope: reverse-coverage + staleness enforcement (fail spec check when a registered spec's source no longer exists, or a spec/source is unregistered). (The PR's Closes #448 auto-closed the full issue prematurely.)

[0xLeif]

Resolved by the Trust 1 / SpecSync 5 adoption (CHG-0001, merged in #497):

• CI enforces `require-coverage 100` in `.github/workflows/ci.yml` — an unclaimed production file now fails the gate, closing the reverse-coverage hole (`src/utils.rs`/`src/meta.rs` are claimed).
• Spec validation delegates to the real `specsync` binary (now 5.2.0, see Fix: bare fledge exits 0 with help; restore cursor on Ctrl+C #499/chore: release v1.7.1 #500/chore: release v1.7.2 #502) instead of the old structural-only check, so a stale spec no longer passes silently.
• The registry is current — no dangling entries, no unregistered live specs. `specsync change check` runs as part of the CI gate.

Closing.