Phase 0 clarification follow-ups + reconcile CI integration seams

Adopt the spec's Phase-0 clarifications (spec now at pin a7fc19f) into the impl:
- schema v1.1: enforce exposure:public => auth.mode!=none (positive+negative tested).
- Kyverno: add longhorn=>size and longhorn=>NOT-reacquirable invariants (R-STATE-02/03).
- Ratify the homelab.keithjackson.dev/* label-key convention (now in spec docs/03).
- R-TEST-06 spec-immutability gate: ci/SPEC_PIN + ci/spec-immutability.sh + gate.sh
  stage + Makefile target + a Gitea job (checks spec repo clean & at pin).
- touched-requirements.sh: conformance tags are the authoritative source.

Reconcile 3 CI seams the CI worker flagged (gate was RED, now GREEN):
- create schemas/validate.sh (SCHEMA_VALIDATE_CMD entrypoint) — L0 schema gate runs.
- fix l1.sh/conformance.sh to run.sh's real interface (fixed _artifacts/ paths; no
  --junit/--coverage) and collect artifacts.
- exec bits on new scripts.

make -C ci gate => PASS (l0 skips locally w/o kyverno binary; green in CI).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

schemas/validate.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# schemas/validate.sh — validate ServiceDefinition YAML against the JSON Schema.
+# The CI L0/L1 gate's entrypoint (ci/lib.sh SCHEMA_VALIDATE_CMD). No cluster needed
+# (R-TEST-02). Usage:
+#   validate.sh <file>...    # exit 0 = all valid, non-zero = a file failed
+#   validate.sh --version    # print the validator version
+set -euo pipefail
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SCHEMA="${HERE}/servicedefinition.schema.json"
+
+if [ "${1:-}" = "--version" ]; then
+  exec check-jsonschema --version
+fi
+[ "$#" -gt 0 ] || { echo "usage: validate.sh <file>... | --version" >&2; exit 2; }
+exec check-jsonschema --schemafile "$SCHEMA" "$@"