test: give the spec gate its own regression suite

Self-review finding: the gate is what keeps the app from drifting off the
feedpak spec, but the gate itself had zero pytest coverage — a refactor
could quietly weaken keys_touched or the allowlist logic and nothing would
notice. The protector needs protecting.

tests/test_spec_gate.py pins the load-bearing behaviours:

- read/write classification: get() reads; subscript Store and setdefault()
  write (the two forms that were blind spots in review); the
  load_manifest-wrapped get; unrelated dicts and non-literal keys ignored.
- exceptions file: duplicate keys and issue-less entries rejected.
- the closed allowlist: growth fails, shrink and steady state pass,
  bootstrap skips.
- live-tree checks, same as CI: READERS matches the codebase, and the only
  non-spec key core touches is the grandfathered original_audio.

Also fixes stale "Layer 2/3" docstrings on check_forward/check_reverse
(they are layers 3/4 since allowlist-closed landed) — the same
docs-lag-the-code class this PR's review kept catching; now the numbering
is asserted by the printed [n/4] headers next to them.

Signed-off-by: topkoa <topkoa@gmail.com>

tools/check_spec_conformance.py

@@ -311,7 +311,7 @@ def check_key_coverage(spec: Path) -> bool:
 
 
 def check_forward(spec: Path) -> bool:
-    """Layer 2 — core must ingest every example pack the spec ships."""
+    """Layer 3 — core must ingest every example pack the spec ships."""
     examples_dir = spec / "examples"
     if not examples_dir.is_dir():
         _fail(f"{examples_dir} is missing — wrong path or bad checkout?")
@@ -366,7 +366,7 @@ def check_forward(spec: Path) -> bool:
 
 
 def check_reverse(spec: Path) -> bool:
-    """Layer 3 — packs committed here must pass the spec's reference validator."""
+    """Layer 4 — packs committed here must pass the spec's reference validator."""
     packs = sorted({p for g in PACK_GLOBS for p in REPO.glob(g)})
     if not packs:
         print("  reverse: no committed packs — skipped")