feat: consolidate and harden SpecGov v1 RC3

[paladini]

Summary

• confine configuration, output, relations, and followed symlinks to the repository root
• bound semantic-auditor input and execute it from the analyzed repository
• add real packed-package installation/CLI smoke and deterministic performance coverage
• remove superseded v0.1 specs, legacy example manifests, and unused documentation assets
• refresh compatible dependencies, Action pins, v1 specs, validation, roadmap, and RC3 release surfaces

Validation

• 54/54 Vitest tests
• build and bundled GitHub Action
• strict TypeScript typecheck
• ESLint and Prettier
• repository harness check
• npm production audit: 0 vulnerabilities
• npm pack dry run: specgov-1.0.0-rc.3.tgz
• SpecGov dogfood check and graph: pass

External release gate

Publishing RC3 remains intentionally gated on npm Trusted Publisher authorization for .github/workflows/release.yml. Existing RC tags remain immutable.