chore: GA-readiness fixes (F1–F6) + Specter 100% structural-coverage gate

[remyluslosius]

GA-readiness review fixes (F1–F6) + Specter 100% structural-coverage gate

Addresses the six GA-readiness findings and adds an enforced 100% structural
Specter coverage gate. Off main, separate from the remediation feature
branches. Eight focused commits.

What landed

#	Area	Change
F6	Hygiene	Removed a stray 34 MB root openwatch build artifact; gitignored the root-level /openwatch path; stripped placeholder credentials from the prototype login.html.
F2	Lint	make lint now warns when the locally installed golangci-lint differs from the version CI pins (1.64.8), so local runs reproduce CI.
F1	Test isolation	SPA static-delivery tests build their handler from a self-contained in-memory fstest.MapFS fixture (newSPAHandlerFS) instead of a magic staged asset filename — they pass against a real vite build, the Makefile stub, or no staged tree. Native package-build tests (make rpm/deb) now skip unless OPENWATCH_PACKAGING_BUILD=1; CI sets it so coverage is unchanged, local go test ./... no longer triggers a multi-minute build.
F5	CI	A failing frontend Vitest suite now hard-fails the build (deferred past specter ingest so coverage is still reported, then a dedicated enforcement step aborts).
F4	Release signing	A v* tag-push release fails closed when no GPG key is configured rather than publishing unsigned packages. Manual workflow_dispatch trial builds stay permissive.
F3	Version/docs	Operator guides referenced 0.2.0-rc.5 while version.env is 0.2.0-rc.10; all guides reconciled, CHANGELOG [Unreleased] entry added.
—	Specter	Enforced 100% structural AC coverage in CI: every acceptance criterion must carry a test annotation; any spec below 100% fails the build. Fixed 3 ACs that had passing t.Run subtests but were missing the // @ac comment (system-connection-profile/AC-08, frontend-settings/AC-25, AC-26). All 108 specs now at 100%.

Two deliberate judgment calls

1. No GA version cut. F3 was framed as "GA promotion," but declaring 0.2.0
   final on main signals production-final intent while the headline
   remediation feature is still on unmerged branches and GA-beta items are
   unstarted. This PR fixes the concrete defect (version inconsistency) and
   leaves the GA-promotion decision to a maintainer.

2. Specter coverage is gated structurally (100%), not by zero-tolerance
   outcome. Zero-tolerance was measured to fail on 6 ACs: 4 are local
   DB-saturation false-negatives (CI's dedicated Postgres service passes them;
   the F1 SPA fix makes two of them robust), and 2 are legitimately
   environment-gated t.Skip() tests (real Kensa corpus via
   OPENWATCH_KENSA_RULES_DIR; the native-package boot harness). A skip is not
   a coverage gap. Forcing zero-tolerance would push those valuable hermetic
   tests to either always run (heavy, wrong lane) or drop their skip guards.
   The two-layer gate — structural 100% (every AC has a test) + threshold
   outcome (the tests that run must pass) — is documented in specter.yaml.

Verification

• gofmt/go vet clean on all touched packages; all workflow + specter.yaml
  YAML parse; specter check passes (108/108).
• SPA tests pass against the real vite build staged on disk (proving F1).
• Packaging build-tests skip locally without the opt-in; the edited
  settings.test.ts passes 26/26.
• Structural gate dry-run: all 108 specs at 100%.

Note: the untracked design prototypes under
docs/engineering/prototypes/openwatch-v1/ are intentionally not included
here (separate concern); the F6 credential strip was applied to the local copy.