feat: complete native execution and Steam discovery

scripts/verify_repo.py

@@ -43,7 +43,7 @@ def check_spec() -> set[str]:
         if duplicates:
             fail(f"duplicate {label} IDs: {duplicates}")
     versions = re.findall(r"^\| \*\*Version\*\*\s+\| ([0-9.]+)", combined, re.MULTILINE)
-    if versions != ["0.18"]:
+    if versions != ["0.22"]:
         fail(f"active specification version markers are stale or ambiguous: {versions}")
     return set(requirements)
 
@@ -100,6 +100,16 @@ def check_verification_entrypoints() -> None:
     missing = [command for command in required if command not in makefile]
     if missing:
         fail(f"Makefile is missing verification gates: {missing}")
+    if "check: verify audit" not in makefile:
+        fail("Makefile must expose the complete local check entrypoint")
+    hosted = [
+        *ROOT.glob(".github/workflows/*.yml"),
+        *ROOT.glob(".github/workflows/*.yaml"),
+        *ROOT.glob(".gitea/workflows/*.yml"),
+        *ROOT.glob(".gitea/workflows/*.yaml"),
+    ]
+    if hosted:
+        fail(f"hosted workflows conflict with the local-only verification policy: {hosted}")
 
 
 def main() -> None: