feat(specs): finalize semantic kernel v2.1 and runtime safeguards

[hapo-nghialuu]

Summary

• introduce the Specs v2.1 semantic kernel with atomic readiness, grounded semantic review, and independent planning-depth and assurance axes
• harden Claude Code and Codex completion authority, semantic-review observation, privacy command analysis, path containment, and packed runtime dependencies
• keep authoring proportional: normalized risk raises assurance to Elevated, while Strict remains explicit and Direct/Compact stay lightweight
• add cross-surface semantic contracts, packed installer regressions, and benchmark/usage guidance

Verification

• node packages/spec/scripts/run-skill-self-tests.mjs
  • 619 tests executed successfully
  • Node phase: 251 passed, 0 failed, 1 opt-in live-host test skipped
  • hook behavioral phase: 162 passed, 0 failed
• git diff --check origin/dev...HEAD
• clean worktree and synchronized docs/.sync_hash

Scope note

This PR contains the seven commits after merged PR #76. Live paired Codex/Claude semantic benchmark runs remain a follow-up; this PR does not claim live runtime parity from static or packed verification alone.