Bootstrap hotpath from engineering spec v0.1

Commit the spec and scaffold the system it describes:

- SPEC.md: the full v0.1 engineering spec
- crates/: trust-layer Rust workspace, unit-tested
  - bench-runner: interleaved ABAB scheduling with discarded warm-ups,
    deterministic bootstrap CIs over the ratio of medians,
    CI-lower-bound accept rule, env fingerprinting, and a CLI with
    compare + A/A self-test modes (A/A verified passing end-to-end)
  - diff-test: gate outcome model, sha256 corpus pin verifier that
    refuses on mismatch, per-target equivalence policy parser
    (byte-identical default, explicit fp-tolerance opt-in)
  - ledger: append-only SQLite attempt schema with UPDATE/DELETE
    refused by triggers, anti-double-attempt query
  - report: cores-saved and dollars/yr ROI math over speedup CIs,
    pricing.toml inputs
- playbook/: classes 1-7 with preconditions, procedure, verification
  notes, and known failure modes per class
- agent/: Python package skeleton — six-tool contract and prompting
  spine, harness IPC deferred to Phase 1
- config/: accept.toml (2% threshold, 30 runs/side), pricing.toml
- targets/, corpora/, results/calibration/: layout and policy docs

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EcKPWQ3MQD4NdEHwar96u2

targets/README.md

@@ -0,0 +1,34 @@
+# targets/
+
+One directory per optimization target. This is the **only**
+agent-writable path in the repository (SPEC §10); everything else is
+trust layer.
+
+## Layout
+
+```
+targets/<name>/
+  target.toml         # upstream repo URL, pinned commit, build & bench commands
+  equivalence.toml    # optional; absent = byte-identical required (SPEC §3.2)
+  workspace/          # agent's checkout — patches land here via harness git-apply
+```
+
+Selection criteria (SPEC §6): CPU-bound (>70% user time), meaningful
+test suite, scriptable workload, permissive license, active but not
+hyper-optimized, builds cleanly in a container. Good hunting: codecs,
+parsers, serializers, image processing, compression, static-site
+generators, linters.
+
+## equivalence.toml
+
+Default (no file) is byte-identical outputs. FP-producing targets may
+declare an explicit tolerance policy:
+
+```toml
+mode = "fp-tolerance"
+abs = 1e-9    # max absolute difference per numeric value
+rel = 1e-6    # max relative difference per numeric value
+```
+
+Declaring a tolerance covers output comparison only; FP *flag* changes
+still route to needs-human-review (SPEC §8).