feat: switch export validation to allowlist model

[corvid-agent]

Summary

• Switches from blocklist to allowlist for export validation in ## Public API sections
• Only ### Exported ... subsections (e.g., ### Exported Functions, ### Exported Types) trigger export validation
• All other subsections (### API Endpoints, ### Route Handlers, ### Component API, ### Configuration, ### Internal Functions, etc.) are treated as informational — no validation errors
• Tables directly under ## Public API (no ### header) are still validated for backwards compatibility

Motivation

Agent feedback from a Rust project: spec-sync was throwing false errors when specs documented non-export API surface — private route handlers, Angular component signals, service methods, interface fields, and infra concepts. The old blocklist (skip Methods/Constructor/Properties) was too narrow. The allowlist approach is granular — a single spec can mix validated exports with informational docs.

Changes

File	Change
src/parser.rs	Replaced blocklist with allowlist check (header.contains("Exported"))
src/parser.rs	Added 2 unit tests for new behavior
specs/parser/parser.spec.md	Updated invariant 3 to reflect allowlist model
docs/spec-format.md	Added "Validated vs Informational Subsections" section with examples
CHANGELOG.md	Added unreleased entry

Test plan

• All 64 unit tests pass (including 2 new tests)
• All 73 passing integration tests still pass (1 pre-existing flaky AI test unrelated)
• specsync check on own repo: 14 specs, 0 errors
• Test with a Rust project that has private route handlers in specs
• Test with an Angular project that has component signals in specs

🤖 Generated with Claude Code