feat(1259-01): deterministic prohibition-enforcement producer + check route

- Author src/prohibition-enforcement.cts: the test-tier prohibition PRODUCER/gate (ADR-550 D5d heavy half)
  locate wired check (node-test|lint-rule) -> confirm fail-first -> run -> build enforcementEvidence -> dispositionForProhibition
  pure/deterministic with injectable runCheck; missing/failing/non-fail-first -> hard-gate (both modes); passing -> green
- Route check prohibition-enforcement in src/check-command-router.cts (same family as ui-plan-gate / tdd-review-checkpoint)
- Add tests/prohibition-enforcement.test.cjs (behavioral, typed-field, injected runner) — new module within <=2 budget
- Register the built bin/lib surface: docs/INVENTORY.md row + regenerated docs/INVENTORY-MANIFEST.json
- .gitignore: add the emitted gsd-core/bin/lib/prohibition-enforcement.cjs (build artifact, ADR-457)
- No src/probe-core.cts edit — the green/fail-closed policy seam already exists

docs/INVENTORY-MANIFEST.json

@@ -344,6 +344,7 @@
       "profile-output.cjs",
       "profile-pipeline-command-router.cjs",
       "profile-pipeline.cjs",
+      "prohibition-enforcement.cjs",
       "project-root.cjs",
       "prompt-budget.cjs",
       "research-provider.cjs",