feat(agent-spec): support dot-prefixed catalog folders

[schickling-assistant]

Why

Catalog discovery used the Unix hidden-name convention as a semantic exclusion. A valid declaration below .managed/ or .retired/ was silently omitted while strict validation still exited successfully with zero agents.

What

• Treat dot-prefixed directories as ordinary organizational catalog hierarchy.
• Share explicit declaration exclusions between discovery and watcher classification: .git, .st2, root pty, and resources/archive/inbox trees.
• Keep dot-prefixed files excluded and preserve existing identity/host path-default behavior.
• Keep lifecycle declaration-authoritative: .retired has no implicit behavior; retired #true remains required.
• Add VRS requirement R22, implementation spec, README guidance, and an invariant with discovery, strict-validation, watcher, and native-path proofs.

This enables an organizational path such as agents/.retired/<host>/<identity>/agent.kdl. Fully path-independent identity and post-unpublish history remain separate in #88 and #89.

Validation

• cargo test -p agent-spec --test discovery (26 passed)
• cargo test --test validate (32 passed)
• cargo test --lib watch::tests (3 passed)
• cargo test --test invariants (1 passed)
• cargo check --workspace --all-targets
• standalone .retired roster + strict-validation reproduction
• nix flake check --print-build-logs (all 6 x86_64-linux checks passed)
• git diff --check origin/main...HEAD

Closes #90.

Posted on behalf of @schickling

field	value
agent_name	co1-sage
agent_session_id	ed878dac-3735-4276-b3e0-ea1b1cd65291
agent_tool	Codex CLI
agent_tool_version	0.145.0
agent_runtime	Codex CLI 0.145.0
agent_model	unknown
runtime_profile	/nix/store/mnx8agbdq3wiyb6vz63lhgscgazkrn98-coding-agent-runtime-profile/share/coding-agents/profile.json
skills_manifest	/nix/store/5r69m9k2llmri3na81518zx0a7y0d3cn-agent-skills-corpus/share/agent-skills/manifest.json
worktree	st2/schickling-assistant/2026-07-30-dot-prefixed-catalog-folders
machine	dev3
tooling_profile	dotfiles@0fb7e03

[myobie]

Closing as superseded by #93, which merged the accepted #88/#90 contract.

An exact patch walk found no required behavior here that is absent from current main. This branch also excludes resources, archive, and inbox at any depth, which conflicts with #93's accepted declaration-parent-only boundary, and it assigns R22 to discovery even though current main reserves R22 for quiet, evented coordination. The additional dot-file and non-UTF-8 cases do not establish a separately accepted behavior gap.

If either of those additions needs a product contract, it should return as a focused issue against current main.