verify-first — the TDD skip the protocol never owned, now a recorded decision

[fall-out-bug]

What

Openspec change verify-first (docs/process, no product behavior changes). Born from the Governor's observation on 2026-09-02: the process-fabric cycle skipped TDD silently — no spec deltas meant no test-writer pass and no red step, and the skip lived only in task reports.

• AGENTS.md (one rule line): verification is written before the work; a skipped test-first pass is a recorded decision in the task report, not a default.
• docs/workflow.md J4 (one procedure bullet): spec-delta tasks get failing acceptance tests from those deltas before implementation (test-writer, then implementer); no-delta tasks restate their verify line as checks run before the work — red where the work is absent; a skip is recorded with what/why/what-covers-it.
• Merge prep: @portolan/core 0.4.1 → 0.4.2, CHANGELOG entry.

Verification

• Task 1.1 was executed under the discipline it installs: pre-work checks run red (rule wording absent), post-work green, judgment checks recorded as the manual skip per design D1 — the reports are the first exemplars of the recorded-skip shape.
• Battery green on the final tree: bun test 372/0 (5 environmental skips named), tsc core+acceptance, validate --specs --strict 10/10, validate --changes --strict 1/1, skill checks, leak-gate.
• Task 1.1 review: PASS/APPROVED (minor fixed). Whole-change review: PASS/APPROVED (two minors fixed). Socratic pre-archive: SHIP; its one delete candidate (the not a default tail) considered and kept with reason in design.md.
• skip_specs: true — docs/process only.