v4.7.0 — import a package for what it does

Two changes, both about paying fewer tokens for the same rules.

The run log left VERIFICATION.md. It grew by one narrative per release and repeated the release page every tag already had. VERIFICATION.md went from about 13,900 words to 2,800. Run narratives now live only on release pages like this one, and the old log is in git history. The tag gate's fifth condition, the README, and the tombstone for a retired pattern all point here. The gate was reworded so it can be met in order: the first four conditions before the tag, the release page after it.

stack/go.md: import a package for what it does, not for one helper. No reflect, tests included. No regexp where strings or strconv will do. Outside the approved table, one small function from a permissively licensed module is copied with its full license notice, not imported. Crypto, escaping, and parsers are never copied. The rule states prohibitions only. Earlier drafts named replacements for reflect and DeepEqual that were not equivalent, and a competent Go engineer needs none. The Context and Zero values bullets were cut against it.

Budgets: the change path went from 8,000 to 7,985, and every floor rose 10 or 11 tokens. The next pattern still needs a budget decision first.

Five rounds of two adversarial passes found 19 defects: 18 in the baseline and 1 in the reference's SPEC.md. The last two passes over the baseline were clean. The ones worth remembering:

• The first draft's "copy the lines" contradicted the slices, maps and cmp.Or rows, which go fix enforces.
• One copyright line satisfies no permissive license.
• Deleting the log left the gate asking for a release page before the tag existed.

Reference: baseline-reference v4.7.0, pinning d12a127, 79 gates, make ci green.