chore(specgit): automate bootstrap around required harness specializations

[LeXwDeX]

This was generated by AI during triage.

Why

SpecGit 1.10.1 runs a harness-currency gate during specgit issue. Generated assets are compared byte-for-byte with the CLI template, but this repository must retain six proven specializations in .github/workflows/specgit-accept.yml:

1. no workflow_dispatch
2. global specgit@1.10.1 installation
3. 45-minute job timeout
4. Node.js 22
5. dependency-free parsing of spec_git/policy.yaml
6. a 40-minute polling deadline below the job timeout

specgit status --json confirms every generated asset is current except this intentionally specialized workflow, which is reported as asset_stale. Consequently a direct specgit issue exits before creating a delivery unless the workflow is temporarily replaced with template bytes.

The gate is bootstrap-only; specgit finish and the PR acceptance verdict remain functional.

Scope

Implement the smallest reversible repository-local solution:

• Add one bootstrap wrapper that snapshots the specialized workflow, refreshes the generated harness, runs specgit issue with unchanged arguments, and restores the specialized bytes on success or failure.
• Preserve the wrapped command's exit code and diagnostic.
• Refuse to run when the relevant files contain pre-existing user changes that cannot be restored safely.
• Update the repository instructions so this wrapper is the only documented bootstrap entry point until SpecGit provides an acknowledged-specialization seam.
• File or link the upstream specialization request, but do not patch the globally installed CLI from this repository.

Out of scope: weakening spec_git/policy.yaml, dropping any specialization without independent CI evidence, or folding unrelated SpecGit integration defects into this delivery.

Acceptance

• One scripted command completes a new SpecGit bootstrap without manual file swapping.
• Before/after hashes of .github/workflows/specgit-accept.yml are identical on both successful and forced-failure paths.
• No unrelated generated asset or user worktree change is modified.
• Existing specgit finish --json acceptance behavior remains unchanged.
• Instructions document the wrapper and the six retained specializations.

Separate follow-ups

• fix(specgit): target delivery pull requests at dev #528: generated pull requests target main instead of dev
• fix(specgit): reject title types unsupported by branch ruleset #529: accepted title types can generate branch prefixes rejected by the ruleset
• fix(specgit): restore delivery state after failed bootstrap #530: failed bootstrap can leak a deleted .specgit.yaml

These are separate WHYs and are intentionally excluded from this issue.

Evidence

• specgit 1.10.1
• specgit status --json: only .github/workflows/specgit-accept.yml is stale
• .github/workflows/specgit-accept.yml:3-15, :38-64, :82-95, :222-234, :306-307
• AGENTS.md, SpecGit local-specializations section
• Commit 8b52b71aa4

[LeXwDeX]

Two more specgit-1.10.1-vs-repo seams surfaced during the #519 delivery (same WHY family — specgit defaults assume a single-tier default-branch flow, this repo runs a two-tier dev integration layer + rulesets):

1. PR base derived as main instead of dev. specgit issue opened draft PR Delivery auto-close-linked #520 with base=main; per the Git Workflow (and precedents fix(core): stabilize dirty worktree removal on macOS #482/fix(sdk): give generated spec and codegen output per-run ownership #485/test(core): normalize .git/HEAD watcher events on macOS #486) feature deliveries target dev. Had to retarget manually (gh pr edit 520 --base dev). Consequences while base was wrong: the SpecGit Acceptance workflow (PR→main only) fired as a stale run, and merging would have aimed the delivery at the heavier main tier, skipping dev integration. Base derivation should be policy- or repo-flow-aware (or at least configurable).

2. Title-type grammar ⊋ branch-prefix whitelist. specgit accepts ci: as an issue title type and derives branch ci/<n>-…, but the repo's branch-naming ruleset only allows feat/fix/chore/docs/refactor/test/release/hotfix — the push was rejected (GH013, exit 3 git_push_failed) and the issue had to be retitled chore: and re-bootstrapped by number. Either specgit maps types to a repo-declared prefix whitelist, or AGENTS.md pins the usable type set to the ruleset's prefixes.

Also noted: the failed exit-3 bootstrap left .specgit.yaml DELETED in the worktree on the next run's validation failure (exit 2 issue_delivery_name_required) — a rollback leak worth reporting upstream alongside the currency-gate seam.

Interim guidance until this issue is resolved: bootstrap via the swap dance (body above), then immediately verify gh pr view <n> --json baseRefName = dev and retarget before filling the brief.

[LeXwDeX]

This was generated by AI during triage.

Agent brief: implement a fail-safe repository-local wrapper for specgit issue. It must temporarily satisfy the 1.10.1 currency gate, restore the six required specgit-accept.yml specializations on every exit path, preserve diagnostics/exit status, and refuse ambiguous dirty-state operation. Do not weaken acceptance policy or modify the installed CLI. #528, #529, and #530 are separate follow-ups and must not be bundled into this PR.

[LeXwDeX]

SpecGit delivery branch: feat/521-specgit-bootstrap-wrapper (draft pull request #532).

[github-actions]

Auto-closed: delivery PR #532 (view) merged into dev with a closing keyword for #521 in its body. GitHub's native auto-close only fires on the default branch (main); this mirrors it for the dev integration layer (#519).