docs(ecosystem): ingest-gate + spec for runner-hardening batch (PR #131)

[rysweet]

What

Downstream deliverable in rysweet/Simard for the six ecosystem problems the Overseer observed against the amplihack runner. The four code fixes live upstream and are not editable here; Simard only consumes the runner as a pinned dependency, so the sole native lever is an audited amplihack-agent-eval rev-bump once the upstream fixes land.

ID	Where the fix lives	Problem	Action here
P1	amplihack-recipe-runner PR #131	Repo Guardian check red (expired ANTHROPIC_API_KEY 401) + E2BIG child-env allow-list	ops rotation + upstream probe — not a rev-bump
P2	amplihack-rs #1018	publish step-14 version-derivation vs pinned test	ingest via rev-bump once landed
P3	amplihack-rs #1025	recipe-runner keeps reflecting after PR is green	ingest via rev-bump once landed
P5	amplihack-rs #1024	signal-subscriber daemons orphaned to init	ingest via rev-bump once landed
P4	amplihack-rs #1015	MERGEABLE all-green PR	merge escalation
P6	rysweet/Simard	16 green PRs vs launch-cap	delivery escalation

Changes

• docs/reference/ecosystem-hardening-pr131.md — the single specification the batch is verified against; honest status: design — not yet implemented.
• docs/howto/ingest-ecosystem-hardening-fixes.md — reactive done-gate: scoped cargo update -p amplihack-agent-eval to an audited SHA (never a moving branch).
• tests/issue_131_ecosystem_hardening_batch.rs — fail-closed acceptance suite: docs contract + premature-bump gate keeping the pin at the audited pre-batch rev 14dc30b1… until upstream lands and is audited.
• mkdocs.yml — registers both pages in nav.

Verification

• cargo test --test issue_131_ecosystem_hardening_batch — 11/11 pass
• cargo test --test docs_integrity — 4/4 pass (nav resolves, no dead links)
• pre-push gate green: race-subset (478 tests) + cargo clippy --all-targets --all-features --locked

Notes

No bridge naming, no stray print!/println!. The forward rev-bump acceptance is intentionally not hard-coded — the target SHA does not exist until P2/P3/P5 merge upstream; whoever performs the audited bump advances EXPECTED_AGENT_EVAL_REV (and Cargo.toml/Cargo.lock) in one RED→GREEN commit, mirroring #2626.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com