feat(seam-linter): add Operator-OS conformance checks

[saagpatel]

What

• Adds the script-only Operator-OS seam-linter v0 for GHRA-owned seam checks.
• Adds generated markdown provenance markers to GHRA compatibility markdown outputs.
• Adds focused pass/fail coverage for freshness, schema pinning, markdown provenance, CLI exit behavior, and worklist-shaped failure output.

Why

Packet 002 needs a tiny GHRA-owned conformance script on the nightly lane so stale or mismatched portfolio truth artifacts fail before downstream operator surfaces trust them.

Review Of What Was Built

• python -m src.operator_os_seam_linter checks portfolio-truth-latest.json freshness and schema pin conformance.
• Generated markdown checks require an explicit provenance marker instead of guessing with content diffs.
• The linter emits non-zero exit codes on failures and can write an existing-worklist-shaped JSON artifact.

Cleanup Review

• Intentionally did not build identity resolution; the named v0.1 extension point remains blocked on dialect census.
• Kept this as a script and tests only; no UI, dashboard, queue, or orchestration surface was added.
• Did not touch consumer repos or ~/.claude.

Verification Summary

• uv run pytest -q -> 2646 passed, 2 skipped.
• uv run ruff check . -> passed.
• Live linter run against /Users/d/Projects/GithubRepoAuditor/output/portfolio-truth-latest.json -> pass, schema 0.7.0, findings [].

Shipped Summary

GHRA now has a tiny scriptable seam-linter for the three census-independent Operator-OS checks, ready to be called from the nightly portfolio maintenance slot.

Next Phase

Land the dialect census separately, then add the v0.1 identity-resolution check from real observed source-id formats and an approved alias map. Main risk is inventing aliases before the census has evidence, which this PR explicitly avoids.

Remaining Roadmap

• Restore the nightly wrapper to the canonical GHRA checkout after this branch lands.
• Run the next nightly-equivalent command from the canonical checkout.
• Keep identity resolution deferred until the dialect census produces the alias map.