Enforce the advertised profile set at dispatch (#136, #138)

[brightbeamarsalan]

SPECIFICATION 15.4 has required since 0.1 that a Coordinator refuse a method whose owning profile the workspace does not advertise, and neither reference did. Removing control/1.0 from a workspace advertised nothing and changed nothing: the governance emergency brake stayed fully live.

The rule is per method. It cannot be written per namespace, as 15.4 had it, because six of the twelve namespaces span profiles. Which profile owns which method is stated once in chap-methods.schema.json, and a generator writes the table each reference dispatches against, so the two cannot drift.

Two carve-outs. The reads, because a workspace must be able to say what it is and to check its own chain, and audit.verify_chain belongs to audit-scitt/1.0 while chaining also turns on through an option. The key lifecycle, reattributed to Core: the shipped MCP server advertises nine profiles and security-signed/1.0 is not among them, so gating rotation and revocation would remove an operator's response to a compromised key from every default deployment.

The refusal is -32601, the answer a Coordinator that never implemented the method would give, so a deployment that omits a profile and one that has it compiled in but unadvertised are indistinguishable from outside.

workspace.create now refuses a descriptor that understates enforcement, and adds the profile where enforcement is on. Advertising still does not turn enforcement on: that would break existing workspaces at their second call rather than at configuration time.

SPECIFICATION gains 6.5, the normative table of what advertising each profile does, which is the thing underneath all of this. Advertising had three meanings and now has one.

Two requirements no reference met leave the normative voice for SECURITY.md: the envelope-id replay refusal and the non-monotonic timestamp refusal, neither of which allocated its error code in either reference, and the second of which 4.3 and 15.4 stated incompatibly. A new CI check makes that class of defect fail rather than accumulate.

The fixtures that called a profile method without advertising it now advertise it. That is the blast radius, and it is the gate working.