CI and the documented gate never run refresh-spec --verify, so an unpinned source-watch entry lands green #324

What

refresh-spec --verify is the standing check that the accepted snapshot still reproduces its receipt (spec/SNAPSHOT.md; docs/architecture/protocol-and-generation.md, Snapshot production). Nothing runs it except a refresh:

• the CI lint job runs generate --verify but not refresh-spec --verify;
• the documented generator gate in docs/engineering/quality-gates.md ("Changes to the protocol, generator, curation, or generated output also run") names generate --verify only.

So a change that adds a spec/source-watch.json entry without its spec/receipt.json pin lands green. #310 did exactly that: it added watch entries for packages/server/src/handlers/generate.ts, packages/core/src/session/generate.ts, packages/core/src/session/command.ts and packages/core/src/session/session.ts with no receipt pins. refresh-spec --verify on master (1d106e6) fails with "the source watch names '…', which the receipt does not record". It surfaced only when the #234 W-5 change ran the verify by hand. That PR pins all four.

Proposed fix

• Add dotnet run --file tools/opencode-tool.cs -- refresh-spec --verify to the CI lint job, next to generate --verify.
• Add it to the generator list in quality-gates.md, and to the CONTRIBUTING relay. It should run whenever spec/ changes, at least.

Cost

About 7 s on the Windows workstation (measured in the #234 gate). Verify hashes the watched files in the external/opencode checkout. The lint job checks out without submodules (generate --verify needs none), so it would need a depth-1 checkout of the submodule (git submodule update --init --depth 1 external/opencode, no bun install); alternatively it can run in a test job that already checks out submodules. No network beyond that checkout: verify is observational, while prepare and apply are the steps that run upstream's generator.

Notes

• Found by the Surface lane during Public signatures that fix an allocation: decide them before the freeze #234 (W-5). The fix of the missing pins rides that PR; the gate gap is recorded here.

• Owner: the Platform lane (the ci.yml lint job and the quality-gates generator list).