docs(m176): amend the spec against the repository, before any code

The spec was written against a repository that no longer exists in six
places, and `AGENTS.orly.md` is explicit that a spec contradicting reality
loses. Amending first means nothing downstream is built against a spec
already known to be wrong.

M175 §6 deleted `make/test-integration.mk` and
`.github/workflows/test-integration.yml`. Evidence: `ls make/test-integration.mk`
→ No such file or directory; `make -qp | grep '^test-integration:'` → no output.
Six places still named that lane — Files Changed ×2, §8 prose, Dimension 8.2,
Test Specification row 8.2, rubric R5.

Replacing the name would have been the wrong fix. M176 genuinely needs live
Postgres and Redis; what it cannot do is JOIN a lane that no longer exists.
The Zig lane went because the Zig daemon is frozen, not because integration
testing ended. So the spec now describes a lane this milestone CREATES:

- `make test-integration-rustd`, named for the existing `test-unit-rustd` /
  `lint-rustd` family rather than reusing the freed `test-integration`, which
  would silently inherit the Zig suite's meaning.
- Built on `make/test-infra.mk`, which M175 KEPT — it is the
  disposable-environment half (compose services, port discovery, Redis TLS CA,
  schema reset) and `make/quality.mk:183` already consumes it. Only the lanes
  half was deleted.
- Declared as `verify.integration` in `.oracle/orly.json`, so `orly gate` and
  the rubric grade one boundary instead of the lane being a target nothing names.
- Run by its own workflow, because `test.yml` carries no `services:` block and
  its `test` aggregate is required — hanging a datastore job off it would make
  live Postgres a precondition for every PR in the repository.

A seventh imprecision is clarified rather than amended: Dimension 1.2's "runs
in the Zig test build". `build.zig` still carries its test steps and Zig 0.16.0
is installed, but no Zig test lane exists; the reverse crypto pass runs as
`zig run`, which is the precedent `make wire-fixtures` already set.

Also filled at PLAN, since EXECUTE may not start without them:

- The PR Intent handshake — intent restated, seven assumptions stated.
- §Coverage decision. codecov.yml's 100% was set when these crates were pure
  value types and its own comment says so. The route taken is to REACH 100, not
  move it: mockable I/O cores per M-MOCKABLE-SYSCALLS behind a `test-util`
  feature, and coverage measured across both lanes since `cargo llvm-cov` runs
  unit and `tests/` targets together. Moving the number stays available for a
  genuinely unreachable line, in the same commit, with the line named.
- §Visibility policy, answering the M175 review note. All 164 public fields are
  in `afd_wire`; `afd_core` has zero. That split is deliberate and kept: wire
  types are transparent serde payloads with no invariant to guard, while every
  crate here is private-by-default — a public field on a secret newtype lets a
  caller move the buffer out and bypass zeroize, which is Invariant 5 defeated
  by syntax.
- §8's credential enumeration, run at PLAN by key presence only, no value read.
  The finding that shapes §8: the datastore URLs are not developer-environment
  credentials at all — they are derived from compose at lane start, which is
  what lets the lane behave identically on a laptop and in CI.

SPEC TEMPLATE GATE: clean — no prohibited patterns, required sections present,
no placeholders, rubric quotes the declared commands.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>