Phase 0 clarification follow-ups + reconcile CI integration seams

Adopt the spec's Phase-0 clarifications (spec now at pin a7fc19f) into the impl:
- schema v1.1: enforce exposure:public => auth.mode!=none (positive+negative tested).
- Kyverno: add longhorn=>size and longhorn=>NOT-reacquirable invariants (R-STATE-02/03).
- Ratify the homelab.keithjackson.dev/* label-key convention (now in spec docs/03).
- R-TEST-06 spec-immutability gate: ci/SPEC_PIN + ci/spec-immutability.sh + gate.sh
  stage + Makefile target + a Gitea job (checks spec repo clean & at pin).
- touched-requirements.sh: conformance tags are the authoritative source.

Reconcile 3 CI seams the CI worker flagged (gate was RED, now GREEN):
- create schemas/validate.sh (SCHEMA_VALIDATE_CMD entrypoint) — L0 schema gate runs.
- fix l1.sh/conformance.sh to run.sh's real interface (fixed _artifacts/ paths; no
  --junit/--coverage) and collect artifacts.
- exec bits on new scripts.

make -C ci gate => PASS (l0 skips locally w/o kyverno binary; green in CI).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

.gitea/workflows/merge-gate.yaml

@@ -44,8 +44,27 @@ env:
   CLUSTER_AVAILABLE: ${{ vars.CLUSTER_AVAILABLE }}
 
 jobs:
+  # R-TEST-06 hard gate: the specification is read-only to agents. Fail the whole run
+  # if the spec repo is modified or has drifted from ci/SPEC_PIN. Runs first; everything
+  # else depends on it. Requires the spec repo checked out beside the impl repo — wired
+  # for when Gitea hosts both. If the spec repo is unavailable the guard SKIPS (exit 3),
+  # tolerated here (surfaced, never a fake green); a real violation (exit 1) blocks.
+  spec-immutability:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4                 # the implementation repo
+      - name: Check out the read-only spec (sibling path)
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ vars.SPEC_REPO_SLUG }}  # e.g. Home-Network/home-network-k3s (set in Gitea)
+          path: ../home-network-k3s
+          fetch-depth: 0
+      - name: Verify spec immutability (R-TEST-06)
+        run: make -C ci spec-immutability || [ $? -eq 3 ]
+
   lint:
     runs-on: ubuntu-latest
+    needs: [spec-immutability]
     steps:
       - uses: actions/checkout@v4
         with: { fetch-depth: 0 }          # full history so touched-requirement diff works