Bootstrap hotpath from engineering spec v0.1

Commit the spec and scaffold the system it describes:

- SPEC.md: the full v0.1 engineering spec
- crates/: trust-layer Rust workspace, unit-tested
  - bench-runner: interleaved ABAB scheduling with discarded warm-ups,
    deterministic bootstrap CIs over the ratio of medians,
    CI-lower-bound accept rule, env fingerprinting, and a CLI with
    compare + A/A self-test modes (A/A verified passing end-to-end)
  - diff-test: gate outcome model, sha256 corpus pin verifier that
    refuses on mismatch, per-target equivalence policy parser
    (byte-identical default, explicit fp-tolerance opt-in)
  - ledger: append-only SQLite attempt schema with UPDATE/DELETE
    refused by triggers, anti-double-attempt query
  - report: cores-saved and dollars/yr ROI math over speedup CIs,
    pricing.toml inputs
- playbook/: classes 1-7 with preconditions, procedure, verification
  notes, and known failure modes per class
- agent/: Python package skeleton — six-tool contract and prompting
  spine, harness IPC deferred to Phase 1
- config/: accept.toml (2% threshold, 30 runs/side), pricing.toml
- targets/, corpora/, results/calibration/: layout and policy docs

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EcKPWQ3MQD4NdEHwar96u2

crates/bench-runner/src/schedule.rs

@@ -0,0 +1,44 @@
+//! Interleaved run scheduling (SPEC §3.1): baseline and candidate run
+//! ABABAB…, never sequential blocks, so thermal and background drift
+//! land on both sides equally.
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Side {
+    Baseline,
+    Candidate,
+}
+
+/// ABAB… schedule with `runs_per_side` measured runs on each side,
+/// preceded by `warmup` unmeasured warm-up entries (alternating too, so
+/// both binaries reach steady state).
+pub fn interleaved(runs_per_side: usize, warmup: usize) -> Vec<(Side, bool)> {
+    let mut plan = Vec::with_capacity(2 * (runs_per_side + warmup));
+    for i in 0..(runs_per_side + warmup) {
+        let measured = i >= warmup;
+        plan.push((Side::Baseline, measured));
+        plan.push((Side::Candidate, measured));
+    }
+    plan
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn strictly_alternating_and_counts_match() {
+        let plan = interleaved(30, 3);
+        assert_eq!(plan.len(), 66);
+        for pair in plan.chunks(2) {
+            assert_eq!(pair[0].0, Side::Baseline);
+            assert_eq!(pair[1].0, Side::Candidate);
+        }
+        let measured_baseline = plan
+            .iter()
+            .filter(|(s, m)| *s == Side::Baseline && *m)
+            .count();
+        assert_eq!(measured_baseline, 30);
+        assert!(!plan[0].1 && !plan[5].1, "warm-ups are unmeasured");
+        assert!(plan[6].1, "runs after warm-up are measured");
+    }
+}