feat(okf): enforce §3 okf_version shape, bump convention 0.1 -> 0.2

The 2026-07-23 reservation said enforcement waits until "the emitters have
migrated". Measured rather than assumed, and the emitter set turned out to be
TWO, not three:

  okr @0059da7       okf_version: 0.1 + okf_layout: kb-layout-2026-06. Migrated.
  linkedin-studio    scaffold.ts:38 -> okf_version: 0.1. Never carried a layout
                     string; has no okf_layout and needs none.
  ms-ai-architect    NOT an emitter. Zero index.md in the repo; okf_version
                     appears in one planning doc. The status table already said
                     "designed, not built" -- only the word "emitters" implied it.

Swept the whole marketplace plus the sibling consumer repos: every live
okf_version value is 0.1. The flip is a no-op today and locks the invariant.

The gate checks SHAPE (/^\d+(\.\d+)*$/), never membership: the upstream value
set is Google's (spec §12), so a bundle targeting a newer version passes. A
membership check would be the convention claiming a set it says it does not own
-- the over-reach class this round has corrected three times. Presence stays
unenforced (reported, not failed) as a separate §3 MUST.

Convention bumped 0.1 -> 0.2 by this log's own criterion: the set of conforming
bundles changed (the spec explicitly said a layout string "conforms today", and
rollout rule 6 defines conformance as gate output). The §12 per-plugin re-check
is pre-measured as finding zero violations.

Also closes a parity blind spot found while landing this: check-okf-parity
compared the okf_version VALUE, which is identical exactly when two impls
disagree about whether it is acceptable -- a false "agree" on the axis the gate
exists to watch. The signature now carries a boolean shape verdict, with
red-marker-layout as the committed red proof. Its "diverge" expectation encodes
okr's lag (they still pure-echo) and flips to "agree" when they mirror it.

And a correction the round earned: portfolio-optimiser enumerated their own
bundle surface and it is four, not three. The dormant fourth
(reference_domain.py:49 -> package data at :70) has no flag form at all, so our
published claim that the re-measurement surfaced "one" unreported entry was
itself one-of-two. Sharpens the standing rule: a search shaped like one entry
type cannot see another; install-vs-fixture is one instance, not the class.

Suite 73 -> 78. coord: PO replied, okr + llm-ingestion-okf notified (the latter
under the standing promise to flag any okf-check.mjs change).

docs/okf-second-brain/spec.md

@@ -4,7 +4,10 @@ A cross-plugin convention for how each plugin stores the **user's own context**
 personal/organizational "second brain" / LLM-wiki — as a portable, interoperable markdown
 bundle, compatible with Google's Open Knowledge Format (OKF) v0.1.
 
-> **Version 0.1 · 2026-06-29 · Cross-cutting catalog artifact, owned by no single plugin.**
+> **Version 0.2 · 2026-07-25 · Cross-cutting catalog artifact, owned by no single plugin.**
+> _(0.2 tightens the §3 floor: `okf_version` is now enforced on shape. Distinct from — and
+> deliberately no longer numerically confusable with — upstream Google OKF v0.1, which this
+> convention targets and does not version.)_
 > Reference design: linkedin-studio's `brain/`. Interop layer: Google OKF v0.1 (thin veneer).
 > Change log + per-plugin rollout status + coordination protocol: `log.md` (same directory).
 
@@ -52,9 +55,12 @@ file path minus `.md`.
   children — **never a filesystem read**; **no frontmatter**, carries progressive-disclosure prose).
 - **MUST** — the bundle-root `index.md` carries an `okf_version` marker (the upstream OKF version the
   bundle targets, currently `0.1`). The value is the **upstream version alone**; a plugin's own layout
-  revision belongs in the optional `okf_layout` marker (§12), never here. **Not yet enforced** — no
-  checker validates the value's shape, so an emitter still carrying a layout string here conforms
-  today. Enforcement waits until the emitters have migrated (`log.md`, STEG 4).
+  revision belongs in the optional `okf_layout` marker (§12), never here. **Enforced on shape** — the
+  gate rejects a value that is not version-shaped (`/^\d+(\.\d+)*$/`), which is what catches a layout
+  snapshot sitting in this field. The check deliberately asserts **nothing about which upstream
+  versions exist**: that value set is Google's (§12), so a bundle targeting a newer upstream version
+  passes. **Presence is not enforced** — an absent marker is reported, not failed; that is a separate
+  step, not this one.
 - **MUST (consumers)** — preserve unknown frontmatter keys, tolerate unknown `type` values, tolerate
   broken cross-links.