demo: adding a frozen invariant the pipeline should catch

[mariusargatu]

This PR is a live demonstration, not a feature and not for merge.

It adds one new invariant to the frozen spec (specs/invariants.md) and nothing else:

INV-8: the sum of a merchant's captured amounts never exceeds its lifetime authorized total

The whole PayFlow thesis is that you cannot change the frozen spec without the pipeline noticing. So the pipeline is expected to be red here, and you can see exactly why without opening anything.

Where to look

• The checks on this PR. Each gate is its own check now. Every check is green except Drift: spec coverage (the gate on the gate), which is red. That one gate refuses the build until the new rule is accounted for: listed in the coverage inventory and given a real oracle in the agent discovered suite.
• The pipeline report job. Its summary renders the full pass/fail matrix, and it uploads a pipeline-report artifact (json and markdown) with every check's result. It runs soft, so it reports every check even though the gate that caught the fault is red.
• The README "Proof you can run" section walks through this exact experiment: https://github.com/mariusargatu/PayFlow#proof-you-can-run-change-the-spec-and-the-gate-stops-you
• The site has the matching panel: https://mariusargatu.github.io/PayFlow/#specproof

Reproduce locally

uv run showcase spec-change

runs the whole pipeline as one soft matrix, seeds this same INV-8, and shows the coverage gate localize it while every other check stays green.

To resolve it for real, a maintainer would add INV-8 to mutation/spec_coverage.json and let discovery propose its oracle, after which the same gate goes green.