Validate native source readiness before requirement evidence import

[djm81]

Problem

The native import runtime from #350 normalizes a pristine official Spec Kit
0.12.15 scaffold into six placeholder requirement records. Requirements
evidence must not be persisted from incomplete native sources. OpenSpec changes
also need an explicit native-validation path when repository policy requires it.

Core-owned scope

• Add an atomic source-readiness result to native OpenSpec and Spec Kit import:
  accepted normalized records, or zero records plus structured diagnostics.
• Reject incomplete official Spec Kit sources with narrow, deterministic
  detection of unresolved template markers, NEEDS CLARIFICATION, no
  substantive Functional Requirement, or no meaningful acceptance scenario
  where user stories are present.
• Under an explicit or strict/enterprise upstream-validation policy, run
  openspec validate --strict --json for the selected change. Return
  source-invalid on validation failure and upstream-validator-unavailable
  when that policy requires a missing CLI.
• Preserve portable basic OpenSpec import when policy does not require the
  OpenSpec CLI; do not probe an ambient binary and make results environment
  dependent.
• Preserve read-only upstream artifacts, stable IDs, SHA-256 provenance, and
  idempotent completed-source imports.

Boundaries

• No SpecFact authoring schema or upstream write-back.
• Do not treat specify check as feature validation; current Spec Kit has no
  native feature-validation CLI command.
• Keep readiness evaluation, source parsing, hashes, and diagnostics in core;
  the modules runtime only delegates and renders results.

Acceptance evidence

• Pristine Spec Kit 0.12.15 scaffold: zero records and
  incomplete-source-template or source-incomplete.
• Completed native Spec Kit feature: normalized records, source hash, scenarios,
  and idempotent re-import.
• Required OpenSpec validation failure or missing validator: zero records and
  named error diagnostic.
• Existing portable valid imports remain read-only and unchanged.

OpenSpec change: requirements-04-upstream-source-readiness
Parent feature: #366
Follow-up to: #350
Modules counterpart: nold-ai/specfact-cli-modules#346 (blocked by this issue)