spec: V16, proofs closures of engineering asseting

(Rolled with v16 wips) V16 work-in-progress progression and the final staged closure into one
    canonical ENGI V16 proving-closure / engineering-assetizing pass.

    This establishes V16 as the active canon and ratifies the full proof-family
    closure work that was rolled through the V16 wip stack. The root V16 spec set,
    notes, system parity matrix, templateguide ratchet, source-side proof surfaces,
    theorem-bearing proof objects, and generated canonical appendix now describe the
    same proof-bearing source-of-truth posture.

    It closes the V16 family-first proving focus across all nine V15 proof
    families. That includes:
    - prompt-completeness closure
    - inference-synthesis closure
    - static-code-analysis closure
    - verification-decisions closure
    - selection-and-materialization closure
    - authorization-and-sensitive-flow closure
    - settlement-source-to-shares closure
    - disclosure-boundary closure
    - proof-contract closure

    The family layer is no longer only named in prose or carried by partial witness
    summaries. Family members, theorem catalogs, theorem verdicts, artifact
    bindings, replay steps, witness paths, replay catalogs, and proof-object field
    shapes are now explicit enough to be rendered, checked, and depended on as
    canonical proof surfaces.

    This also lands the final source-side tightening needed to make generated proof
    appendices reliable rather than interpretive. The proof-family catalog now
    names proof artifact paths and member ids directly. Selection/materialization
    witness closure now carries its own family proof artifact. Policy release
    classifications are extended across the proof-relevant artifacts that the
    appendix and verifier surfaces now depend on. The result is that proof-bearing
    branch artifacts, witness manifests, replay catalogs, and disclosure classes
    now close under the same V16 proof contract.

    With that closure in place, V16 also ratifies the generated canonical appendix
    path. `_PROVEN_` is no longer a drafting intention or a hand-maintained report.
    The repo now has:
    - a source-side `_PROVEN_` generator
    - a strict check mode
    - package scripts for regeneration/checking
    - templateguide language requiring regeneration on canonical version commits
    - and the versioned generated appendix included alongside the canonical bump

    The appendix is rendered from the proof-bearing runtime surfaces themselves:
    proof-family proof objects, theorem/member verdict catalogs, artifact bindings,
    replay steps, the system proof bundle catalog, the verifier replay catalog, the
    witness-manifest keyed digest inventory, the deliverables manifest, the policy-
    release classifications, and the full seeded scenario/run matrix.

    In effect, this commit turns the rolled V16 proving work into the actual
    canonical state: proof-family closure, member closure, theorem-by-theorem
    closure, replay/witness closure, generated appendix closure, and the release-
    process ratchet now all describe the same system.

    Verification for the rolled canon is green:
    - `npm run typecheck` (engi-demo)
    - `npm test` (engi-demo, 75/75)
    - `node scripts/generate-engi-proven.mjs --version V16 --commit d6e1523 --output ENGI_SPEC_V16_PROVEN.md --allow-dirty`
    - `node scripts/generate-engi-proven.mjs --version V16 --commit d6e1523 --output ENGI_SPEC_V16_PROVEN.md --check --allow-dirty`

Author: geraldarthurdavis

ENGI_SPEC.txt

@@ -1 +1 @@
-V15
+V16