feat(loop-readiness): add fail-closed LC-01 loop readiness gate

[creayma-del]

Summary

Adds the LC-01 fail-closed loop runtime readiness gate: a versioned readiness contract (v1, 14 capabilities x 5 levels), a pure evaluator, and a better-harness loop readiness CLI that decides whether a caller-declared capability assessment allows a proposed loop run level. The gate never probes hosts, network, or the workspace; absent required capabilities report unavailable and prevent the level, and any input the assessment contract rejects exits 1 without ever producing a decision (exit codes: 0 allowed, 2 prevented, 1 invalid input).

Why

• Issue/Story: roadmap.md LC-01 (Loop Control Plane, P0) — "Fail-closed loop runtime readiness gate".
• User or maintainer outcome: schedulers and loop harnesses get an executable, deterministic gate for run levels instead of prose guidance; unproven capability declarations can never silently degrade into an allowed run.

Traceability and Scope

• Spec/ADR, if applicable: docs/specs/2026-07-31-lc01-loop-readiness-gate.md (Status: Implemented; reviewed through an expert spec review plus three acceptance rounds — all P1/P2/P3 findings resolved in-spec and in-code).
• Acceptance criteria addressed: AC-1 through AC-7 (contract shape and version rejection, allowed/prevented envelopes, absence-as-unavailable, CLI exit-code and parser-safe output contract, import/IO boundary, full-suite and fixture coverage, doc-link integrity).
• Canonical owners changed: new capability directory scripts/loop-readiness/ (contract, evaluator, CLI); new reference references/loop-engineering/readiness-gate.md.
• Explicit non-goals: no host/provider probing, no run-directory writes, no scheduler wiring (LC-06), no state policy (LC-04), no observability pipeline (LC-10).

Change Type

• Feature
• Bug fix
• Tests only
• Documentation/community
• Refactor with no intended behavior change
• Dependency, packaging, or infrastructure

Test and Review Evidence

Check	Result
node --test test/loop-readiness.test.mjs	25/25 pass (contract shape, allowed/prevented envelopes, invalid-input matrix, import allowlist with obfuscation defenses, empty-tmpdir spawn, facade byte parity)
npm test	1048/1048 pass
node --test test/scripts-refactor-contract.test.mjs	7/7 pass (frozen root-help and inventory/schema hashes regenerated for the new loop group only)
node --test test/doc-link-graph.test.mjs	6/6 pass; routing graph regenerated, 34 files / 50 links unchanged
Mutation checks	Removing the no-arg help branch and injecting an indented import "node:os"; each turn exactly one guard test red; both restored clean
Boundary probes	25+ adversarial inputs across three acceptance rounds (BOM, numeric/array evidence, case variants, 10MB duplicate array, null elements, obfuscated imports, paths with spaces) — all fail-closed with the documented error codes

Manual or visual evidence: smoke runs — loop readiness --level scheduled-bounded-apply --assessment mixed-partial-failed.json exits 2 listing 9 blocking capabilities; --level bogus --json exits 1 with the loop-readiness-error envelope; facade output verified byte-identical to direct invocation.

Risk and Recovery

• Compatibility and cross-platform impact: purely additive; no existing command behavior changed. CLI uses argv-array spawn and no OS-specific paths; assessment paths resolve against the caller's cwd via readFileSync.
• Package, plugin, schema, or generated-file impact: commands --json / OpenCLI schema output gains the loop group; frozen baselines (root-help.txt, two sha256 hashes) regenerated to match, diff limited to the new group.
• Rollback or recovery path: revert the single commit; no data, config, or migration surface.
• Residual risk or unverified boundary: the static import-allowlist test is regex-based rather than AST-based; residue-token defenses cover all obfuscation forms found across three review rounds.

AI Involvement

• Level: Generated (agent-authored under maintainer direction).
• Human review and validation: maintainer directed an expert spec review (3 P1 / 6 P2 / 6 P3 resolved) and three acceptance review rounds including mutation verification; full test suite and smoke runs executed and reported above.

Checklist

• I followed AGENTS.md, CONTRIBUTING.md, and the relevant canonical-owner guidance.
• The change is focused and does not include unrelated local or generated state.
• Tests and documentation match the behavior actually delivered.
• Markdown links were checked when documentation moved or changed.
• Cross-platform behavior was considered for Windows, macOS, and Linux.
• Package/runtime verification was run when shipped files or dependencies changed.
• User-facing or compatibility changes are recorded in CHANGELOG.md.
• I have the right to contribute this work under the repository's MIT License.