feat(ai-integration): API-coverage verify:pre gate (#1562)

Full API Coverage by Default — Opt Out, Never Opt In. A phase that integrates
an external API/SDK/service can no longer seal without a decided coverage matrix.

- src/api-coverage.cts: deterministic detector (compound verb+noun signal +
  <Service> API/SDK surface; stopword-guarded; strips fenced code) + matrix
  parse/validate/render with field-length caps.
- check api-coverage.verify-pre: blocking seal-time gate; phase arg resolved as
  a token under .planning/phases/ only (traversal-neutralized); validates
  COVERAGE.md or blocks iff a strong integration signal is detected and no
  matrix exists; fail-closed when phases tree exists but phase unresolvable.
- capabilities/ai-integration: workflow.api_coverage_gate config key (default
  true), plan:pre contribution, blocking verify:pre gate. Data-driven.
- gsd-core/workflows/verify-work.md: generic verify:pre gate dispatch.
- Tests: detector FP/FN + matrix validation + fast-check bijection; gate e2e.
  Code+security review findings fixed (stopword FP, scope containment, pipe/cap
  rejection, prompt-injection message hygiene).
- Regenerated registry/matrix/loop-host-contract/goldens/baseline + docs.

Closes #1562

tests/fixtures/golden-install-parity/opencode.json

@@ -123,6 +123,7 @@
   "gsd-core/references/agent-skills-bootstrap.md": "51b5d0ba5b1e98d9",
   "gsd-core/references/ai-evals.md": "b5afa786b938671e",
   "gsd-core/references/ai-frameworks.md": "425dd69c629230e7",
+  "gsd-core/references/api-coverage.md": "205a43c5fa7c221c",
   "gsd-core/references/artifact-types.md": "218c55caf8aff6df",
   "gsd-core/references/autonomous-smart-discuss.md": "3986d58011bf9006",
   "gsd-core/references/checkpoints.md": "9feb961f644afa96",
@@ -179,7 +180,7 @@
   "gsd-core/references/planner-reviews.md": "da39eace09a10743",
   "gsd-core/references/planner-revision.md": "86ba8a511f081f05",
   "gsd-core/references/planner-source-audit.md": "7de5bdb07232ce0b",
-  "gsd-core/references/planning-config.md": "aad463ddda23dbaf",
+  "gsd-core/references/planning-config.md": "37ab69107a2f7dc6",
   "gsd-core/references/prohibition-probe-fixtures/01-streak-reminder/expected.json": "f10df472f2846cc6",
   "gsd-core/references/prohibition-probe-fixtures/02-clean-utility/expected.json": "31e8a781eeffe020",
   "gsd-core/references/prohibition-probe-fixtures/03-multi-prohibition/expected.json": "70a532a7cc1b6ae8",
@@ -379,7 +380,7 @@
   "gsd-core/workflows/update.md": "71b6cd852f38b4bc",
   "gsd-core/workflows/validate-phase.md": "abcdbc1b56780565",
   "gsd-core/workflows/verify-phase.md": "126be1d026900102",
-  "gsd-core/workflows/verify-work.md": "f0d205568abfaf74",
+  "gsd-core/workflows/verify-work.md": "ae07b3fa8b6f864e",
   "hooks/gsd-check-update-worker.js": "385fb7c67810baf6",
   "hooks/gsd-check-update.js": "4549451414ffa7d7",
   "hooks/gsd-config-reload.js": "96546e0e8bb47904",