test(harness): gate portable role secret and authority drift

## Parent
- #436

## Goal
Turn the portable-role security and authority boundaries into CI failures rather than prose-only rules.

## Scope
- Scan tracked role specs and both generated surfaces for credential/token/private-key material and runtime Directory ULIDs.
- Prove credential cache paths stay gitignored and require mode 0600 at runtime.
- Prove only `coord-main` has merge authority and only coordinator kinds can dispatch.
- Prove generated files match the neutral YAML role source.

## Acceptance
- Positive and counterexample fixtures cover every gate.
- A deliberately leaked token-like value, ULID, duplicate merge authority, or generated drift fails the test.
- Gate runs in the standard harness/CI path.
- `./init.sh` passes.

## Dependencies
- #436
- portable surface generator child
- stable role resolver child
- persistent role lifecycle child

Start with the standard harness/CI path, ./init.sh, and the neutral YAML role source. Inspect tracked role specs, both generated surfaces, and credential cache handling, then use positive and counterexample fixtures to cover each stated boundary. Done means every listed drift or leak fails in CI while valid roles pass and ./init.sh succeeds.

Written by the indexing model from the issue text.