Bootstrap hotpath from engineering spec v0.1

Commit the spec and scaffold the system it describes:

- SPEC.md: the full v0.1 engineering spec
- crates/: trust-layer Rust workspace, unit-tested
  - bench-runner: interleaved ABAB scheduling with discarded warm-ups,
    deterministic bootstrap CIs over the ratio of medians,
    CI-lower-bound accept rule, env fingerprinting, and a CLI with
    compare + A/A self-test modes (A/A verified passing end-to-end)
  - diff-test: gate outcome model, sha256 corpus pin verifier that
    refuses on mismatch, per-target equivalence policy parser
    (byte-identical default, explicit fp-tolerance opt-in)
  - ledger: append-only SQLite attempt schema with UPDATE/DELETE
    refused by triggers, anti-double-attempt query
  - report: cores-saved and dollars/yr ROI math over speedup CIs,
    pricing.toml inputs
- playbook/: classes 1-7 with preconditions, procedure, verification
  notes, and known failure modes per class
- agent/: Python package skeleton — six-tool contract and prompting
  spine, harness IPC deferred to Phase 1
- config/: accept.toml (2% threshold, 30 runs/side), pricing.toml
- targets/, corpora/, results/calibration/: layout and policy docs

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EcKPWQ3MQD4NdEHwar96u2

justfile

@@ -0,0 +1,29 @@
+# hotpath task runner. `just --list` for a summary.
+
+# Build the trust-layer workspace
+build:
+    cargo build --workspace
+
+# Run all trust-layer unit tests
+test:
+    cargo test --workspace
+
+# Lint: warnings are errors in the trust layer
+lint:
+    cargo clippy --workspace --all-targets -- -D warnings
+    cargo fmt --all --check
+
+# A/A self-test of the bench harness against a sample command.
+# Must print a null verdict; an "accept" is a calibration failure.
+aa cmd="sleep 0.05":
+    cargo run -p bench-runner -- --config config/accept.toml aa --cmd "{{cmd}}"
+
+# Interleaved A/B comparison of two shell commands
+compare baseline candidate:
+    cargo run -p bench-runner -- --config config/accept.toml compare \
+        --baseline "{{baseline}}" --candidate "{{candidate}}"
+
+# Verify a target corpus against its pinned manifest
+# (wired through diff-test CLI once it exists; manual check for now)
+pin-check target:
+    cd corpora/{{target}} && sha256sum -c MANIFEST.sha256