Fix: complete merged SpecSync lifecycle

[0xLeif]

Summary

• Replace invalid bot lifecycle evidence with authorized 0xLeif definition and closing approvals.
• Correct the public-contract acceptance criterion and record complete three-requirement semantic deltas.
• Verify and accept the Trust adoption, stable Augur 1.0 lockfile, and released plugin contract.
• Expand SDD verification to the full release-build and deterministic contract-test lane.
• Add standard main-branch protection requiring trust and one independent review.

Why

The original migration PR merged green, but its three SpecSync changes remained implementing. This follow-up makes the merged governance state truthful and fully verified rather than treating the incomplete lifecycle as grandfathered.

Test Plan

• fledge lanes run verify
• swift build -c release
• bash Tests/plugin_contract_test.sh
• specsync check --strict --force --require-coverage 100
• specsync change check --strict --require-coverage 100
• All three changes accepted with valid human approvals
• Hosted trust and native checks
• Independent GitHub approval

Accepted changes can be archived only after this delivery diff merges.

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!