Derive the gates that re-derive from a package's export surface

Six gates re-derive their population from `@objectstack/spec`'s public
export surface, and every one was absent from the derivation for
`packages/spec/src/index.ts` -- the entry point that IS their subject.
One shape, one hole.

None of them spells that subject as a path. Each reads the package
manifest, walks its `exports` map, and resolves each subpath into a
built `dist/` that is untracked by construction. The derivation models
three follows and all three end at a PROGRAM whose declared population
it can inherit; a manifest is not a program, so the whole class ended
at a read that contributed nothing.

Adds the fourth follow -- the manifest edge -- routed through the same
pieces as the other three: the followed file's own declaration decides
what a caller inherits (here the `exports` map), `hintOrigin`/`hintEdge`
label it so it never travels as a claim the gate made itself, and it is
appended last so it can only fill a hole. A gate must READ the exports
map to follow it: three live gates read a manifest for `.version` or the
`scripts` map and inherit nothing.

Also reads a package root held in a PARAMETER (one call site, one
value), consulted only where nothing binds the name -- the branch that
returned `unknown` before -- which is the spelling one of the six uses.

Measured over 199 families x 7762 files: 166173 -> 172797 pairs (+6624),
0 lost, 0 re-attributed, 6 verdicts changed. A seventh live gate the
card never named, `check:dual-build-cjs-loads`, is covered by the same
edge, and the self-test pins an eighth that exists nowhere but the case.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

Author: claude