[todie]

Linear: EST-1169 (parent CER-2890). Spec touched: none, because this is a process and hygiene change. The triage record retro-links to SPEC-0001.

Why

dgr moved into the saga lane on 2026-10-18. The estate standard says every repo is spec-first with LeanSpec, checked on every PR. dgr already had specs/ and SPEC-0001. It had no .lean-spec marker, no agent rule and no PR check.

What

• .lean-spec marker, pointing at the existing specs/ registry.
• AGENTS.md with the spec-first rule: a feat or fix updates a spec, and the PR names it (SPEC-NNNN or a REQ id).
• .github/workflows/lsc.yml, which runs on the internal estate fleet (ent-default, which accepts public repos in this org). It runs only for same-repository PRs, so fork code never reaches an internal runner. It has three steps:
  • a structural spec check (.lean-spec present; each specs/SPEC-NNNN-*.md has front matter and a status);
  • an lsc check specs/ stub, until vilicus ships the pinned lsc;
  • a warning-only spec-link check that always exits 0. It extends the audit patterns with dgr's SPEC-NNNN naming, and PR text reaches it only through env:.
• docs/leanspec-history-triage.md, covering all 6 first-parent commits on main: 1 linked, 2 retro-linked to SPEC-0001, 3 exempt.

Not in this PR

• The existing ci.yml and release.yml jobs still run on GitHub-hosted ubuntu, windows and macos runners. Moving them needs a decision about Windows and macOS runners, so it is a separate PR.
• Required checks and PR-required branch rules are a settings change, not made here.

Evidence

• actionlint passed, ignoring only the custom ci-rust runner label, and the YAML parses.
• The structural check passes on this tree and fails with exit 1 when .lean-spec is removed.
• The spec-link logic was tested locally on 5 inputs:
  • a feat title with no spec warns;
  • a title naming SPEC-0001 passes, as does a fix!: title naming REQ-0001-04;
  • a docs title is skipped;
  • a 65 KB body naming a spec passes.
• The commit is signed.