feat(autonomy): generated identity-and-prerequisite emission with drift gate

[kyle-sexton]

Phase 3 of the routine-capability-detection plan (ADR 0011; planned via #2685). Depends on the
Phase 2 leaf sections (#2718) being merged.

The bridge the resolver needs and the single-home rule forbids authoring twice: one
machine-readable emission (JSON, in-plugin, generated) listing every v1 identity with its
derived prerequisite set, generated from the leaves with a --check drift gate — the
generate-plus-check pattern the catalog generator established. The leaves stay the authored
single home; the emission is derived output; drift between leaves and emission fails CI.

ADR-0004 incumbent evidence (inlined)

• No structured identity registry exists: scripts/generate-catalog.mjs builds
  docs/CATALOG.md from plugin manifests and never sees routine identities; the only
  structured posture-qualified identities in the tree are security-binding test fixtures.
• The generate-plus---check drift-gate shape is the incumbent pattern being reused, not a new
  mechanism.

Work items

• Generator + --check mode (Node .mjs, beside the setup skill's existing conformance
  scripts), with a co-located *.test.sh and test manifest per the plugin's existing
  conformance-script shape.
• The emission is a generated in-plugin artifact, not consumer configuration: no new
  config-file family; consumers other than the resolver and CI are out of scope.
• git update-index --chmod=+x for any new shebang file before commit (the exec-bit gate
  is repo-wide and ungated; on Windows core.filemode is false and git add records
  100644).
• Version bump: assert the manifest version differs from origin/main AND
  scripts/check-changelog-parity.sh --check-bump origin/main exits 0.

Sanity checks

• The --check mode exits non-zero on a hand-edited emission (drift fixture) and 0 on a
  regenerated one.
• Every identity named in a leaf appears in the emission and vice versa.
• scripts/check-orphaned-fixtures.sh --check exits 0 (every fixture consumed by the test
  harness).

Related

• ADR 0011; Refs spike: per-repo routine capability detection — promote to its own topic #2685; depends on feat(autonomy): per-identity prerequisite sections in the ten v1 routine leaves #2718