Add journey-integrity gate: edge: resolver + Surface tag (ADR-0077)

[rdimitrov]

Implements the ac-trace side of a journey-integrity design (ADR-0077) developed with the original consuming repo — make the verify: gate prove journeys, not just layers.

Opt-in — nothing changes for a repo without .actrace.yml

Every new check is gated behind an optional .actrace.yml. Absent ⇒ zero Config ⇒ every feature off, so repos that don't opt in are unaffected. journey_integrity: true turns on the Surface/journey-proof gate; resolvers: maps a custom verify: prefix to a command.

What lands

• config.go — the .actrace.yml loader. Missing file ⇒ zero value (no error); malformed ⇒ hard error (a typo mustn't silently disable a gate).
• resolver.go — a generic verify-method prefix→command hook. edge:agentloop->files.GetFile is resolved by invoking the configured command with the raw token as one argv element, no shell (CWE-78/88); exit 0 = holds, non-zero = doesn't. A custom-prefix token with no configured resolver is a hard failure, never a silent no-op.
• journey.go — the **Surface:** scenario tag + journey-proof gate. A user-facing scenario must carry ≥1 AC citing a journey proof, gated on location and substance:
  • a ui-e2e-realfd: spec that asserts on a real server response (waitForResponse), not DOM alone; or
  • a test/e2e/ Go test that is a real-cluster run (//go:build e2e, not synthetic, no idpfake).
  • A mock spec, a unit test, a faked-seam test/e2e/ test, or a demonstration/scenario/manual method can't satisfy it. Missing/unrecognised/ambiguous tags hard-fail. A pre-existing scenario grandfathers with journey-ok: only if it cites a tracked issue.

Tests

7 enforcing tests + config/token-filter/exit-code units. go test -race, go vet, golangci-lint run (gosec + exhaustive + …), and gofmt all clean. The FE ui-* vocabulary and existing gates are untouched.