ci: validate openspec specs and changes

Adds a fast standalone job that runs `openspec validate --all --strict`
via npx, gating PRs on spec/change well-formedness.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -45,6 +45,16 @@ jobs:
       - uses: actions/checkout@v6
       - run: bash scripts/check-dockerfiles.sh
 
+  openspec:
+    name: OpenSpec Validate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+      - run: npx -y openspec@1.2.0 validate --all --strict --no-interactive
+
   typecheck:
     name: Typecheck
     runs-on: ubuntu-latest