chore: take in the 16 Sep bundle — lib, curriculum v5, prompt, gate audit

The artifact was reworked after real incidents: a week of lost data, a
student taught out of order, and spelling diagnoses the model invented.
This takes the new export in verbatim; the port catches up in the
commits that follow.

Copied byte-identical from the bundle:
  lib/        lexicon.js and sync.js are new; gate.js gains enforcement,
              hangul.js letter-level marking, srs.js recall evidence,
              conjugation.js deconjugate(); blocks.js now takes the last
              block, closes gloss at "=", and parses recall, ::result and
              ::confirmed
  data/       curriculum.json v5 — six 다지기 phase reviews; the 371
              roadmap words are unchanged and no band moves
  prompt/     English-only rule, recall, LETTER-LEVEL CHECK, marking
  audit-gate.mjs, run-checks.sh, fixtures/  — the word gate measured
              against 54 real tutor messages

CI runs run-checks.sh in place of validate.mjs alone, and `npm run check`
gains the audit. Baselines: validate PASS 0/0; audit 7 of 41 and 2 of 13.

types/lib/ declares the new API, and test/lib/ pins it: letterCheck on
the prompt's own 짧다/빫다 case, deconjugation, the roadmap-first order
that keeps 마셔 out of Phase 1, sync's three gates, and recall evidence —
including the two ways lib's evidence is looser than PORT.md, pinned as
they are so the call site that tightens them is visibly needed.

TaskHost gains a plain recall renderer so the tree typechecks against the
wider Task union.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -12,11 +12,15 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      # The curriculum gate comes first, before anything else can run.
-      # validate.mjs reads only data/ and lib/ and exits non-zero on a
-      # blocking failure. Baseline: PASS — 0 blocking, 0 advisory.
-      - name: Curriculum validation
-        run: node validate.mjs
+      # The bundle's own checks come first, before anything else can run.
+      # Both read only data/, lib/ and fixtures/ and exit non-zero on failure:
+      #   validate.mjs   — curriculum sequencing. Baseline: PASS, 0 blocking, 0 advisory.
+      #   audit-gate.mjs — the word gate against 54 real tutor messages.
+      #                    Baseline: 7 of 41 and 2 of 13 flagged. Too many
+      #                    means it rejects real teaching; too few means
+      #                    violations reach the student.
+      - name: Curriculum validation and gate audit
+        run: sh run-checks.sh
 
       - uses: actions/setup-node@v4
         with: