[v0.1 W3] klasp gate runtime + trigger + Shell CheckSource

[liam-ai-reality]

Week 3 of v0.1 implementation. References: design.md §6, §10.

• klasp/src/sources/shell.rs — Shell CheckSource impl: spawn sh -c {command}, capture stdout/stderr, optional verdict_path JSON extraction, timeout handling
• klasp/src/cmd/gate.rs — full gate flow per design.md §6:
  1. read KLASP_GATE_SCHEMA env (fail-open on mismatch)
  2. parse stdin via GateProtocol::parse (fail-open on parse error)
  3. extract tool_input.command, classify via Trigger
  4. load klasp.toml (fail-open on missing/parse error)
  5. run checks sequentially via SourceRegistry
  6. aggregate via Verdict::merge + policy
  7. exit 2 + structured stderr if blocking, exit 0 otherwise
• Trigger regex unit tests: matches git commit, git push, && git push, ; git commit; rejects forgit commit, mygit push
• Integration test (klasp/tests/gate_flow.rs) using a captured real Claude tool-call JSON fixture in tests/fixtures/claude_commit_hook.json
• Contract test (klasp/tests/protocol_contract.rs): asserts both fixture script's KLASP_GATE_SCHEMA AND render_hook_script() output equal GATE_SCHEMA_VERSION