fix(scripts): the ADR-0087 gate's parser-rot witness is generated at the judged rev, never read from a committed spec-changes.json (#22485)

check-adr-0087-registration read packages/spec/spec-changes.json at HEAD as
its witness that extractIds() still sees every migration id the build sees.
Since the committed copy stopped being regenerated it ages, and a migration id
withdrawn from the registry would have stayed in it and false-redded the gate;
deleting the copy would red it outright. The witness is now generated at the
rev being judged: git archive of that rev's generator inputs, the package's own
build-spec-changes.ts --out under the checkout's tsx. Every failure to produce
it is a red input, never a skip.

Self-test: battery W1-W6 drives the real generatedWitness over a fixture
generator (withdrawn id green, head-not-worktree, missing/failing/silent
generator, no tsx); I1 and the entry-point run go through the real path too.
objectui-changeset-digest's fw-gate sandbox stages the same stand-in generator.

Claude-Session: https://claude.ai/code/session_01VZqqwTj2wsihZEbfT6yyYN
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude