feat(ai-integration): API-coverage verify:pre gate (#1562)

Full API Coverage by Default — Opt Out, Never Opt In. A phase that integrates
an external API/SDK/service can no longer seal without a decided coverage matrix.

- src/api-coverage.cts: deterministic detector (compound verb+noun signal +
  <Service> API/SDK surface; stopword-guarded; strips fenced code) + matrix
  parse/validate/render with field-length caps.
- check api-coverage.verify-pre: blocking seal-time gate; phase arg resolved as
  a token under .planning/phases/ only (traversal-neutralized); validates
  COVERAGE.md or blocks iff a strong integration signal is detected and no
  matrix exists; fail-closed when phases tree exists but phase unresolvable.
- capabilities/ai-integration: workflow.api_coverage_gate config key (default
  true), plan:pre contribution, blocking verify:pre gate. Data-driven.
- gsd-core/workflows/verify-work.md: generic verify:pre gate dispatch.
- Tests: detector FP/FN + matrix validation + fast-check bijection; gate e2e.
  Code+security review findings fixed (stopword FP, scope containment, pipe/cap
  rejection, prompt-injection message hygiene).
- Regenerated registry/matrix/loop-host-contract/goldens/baseline + docs.

Closes #1562

tests/fixtures/golden-install-parity/codebuddy.json

@@ -123,6 +123,7 @@
   "gsd-core/references/agent-skills-bootstrap.md": "5ab875054b1adda9",
   "gsd-core/references/ai-evals.md": "b5afa786b938671e",
   "gsd-core/references/ai-frameworks.md": "f827de93dde124eb",
+  "gsd-core/references/api-coverage.md": "66264d41dfd9154a",
   "gsd-core/references/artifact-types.md": "a6d2e1f9453ffbf5",
   "gsd-core/references/autonomous-smart-discuss.md": "2fc710cde0ec7785",
   "gsd-core/references/checkpoints.md": "6aa620c6ca38bdf0",
@@ -179,7 +180,7 @@
   "gsd-core/references/planner-reviews.md": "dda0193a0fbd4947",
   "gsd-core/references/planner-revision.md": "86ba8a511f081f05",
   "gsd-core/references/planner-source-audit.md": "7de5bdb07232ce0b",
-  "gsd-core/references/planning-config.md": "eb168188abd00101",
+  "gsd-core/references/planning-config.md": "ac409835e8260a3e",
   "gsd-core/references/prohibition-probe-fixtures/01-streak-reminder/expected.json": "f10df472f2846cc6",
   "gsd-core/references/prohibition-probe-fixtures/02-clean-utility/expected.json": "31e8a781eeffe020",
   "gsd-core/references/prohibition-probe-fixtures/03-multi-prohibition/expected.json": "70a532a7cc1b6ae8",
@@ -379,7 +380,7 @@
   "gsd-core/workflows/update.md": "5ff1f77222977648",
   "gsd-core/workflows/validate-phase.md": "2c6d7671fcaabcaa",
   "gsd-core/workflows/verify-phase.md": "22f18492581f1da5",
-  "gsd-core/workflows/verify-work.md": "34e980a6950cd83c",
+  "gsd-core/workflows/verify-work.md": "63b3f680d8f0a6f3",
   "hooks/gsd-check-update-worker.js": "bdc9324a2f080ddd",
   "hooks/gsd-check-update.js": "b7669f605631e506",
   "hooks/gsd-config-reload.js": "96546e0e8bb47904",