Validate project spec through structured reader

[cbusillo]

Summary

• replace the hand-written indentation-sensitive project.yml parser with the repository's canonical Ruby YAML reader
• decode the canonical JSON into a Sendable typed model and assert semantic arrays, booleans, strings, dependencies, and settings
• bound reader execution with temp-file capture, timeout cleanup, and redacted diagnostics
• scan base and every configuration for retired Google OAuth build settings

Refs #578

Validation

• semantics-preserving supportedDestinations block-style mutation failed before this change and passes now
• Watch SKIP_INSTALL: false mutation fails the typed boolean assertion
• Release-only CONTEXT_PANEL_GOOGLE_CLIENT_ID mutation now fails; the old base-only test missed this class
• reader nonzero exit produces bounded diagnostics
• reader timeout fails after 15 seconds with no orphaned reader process
• 16 focused entitlement/project tests passed
• routine Swift lane passed 893 tests
• 34 surface-manifest contract tests passed
• scripts/commit-gate.sh
• JetBrains changed-files inspection found only existing spelling hits on product identifiers; no semantic Swift finding
• Opus exact-SHA final review approved ba32823; Gemini was invoked for planning and final review but returned no usable text

Scope

• one test file: Tests/ContextPanelCoreTests/ReleaseEntitlementsTests.swift
• no changes to project.yml, the governed Ruby reader, production code, or release fingerprints