AM-4: gate scenario YAML, retarget on audited source, re-measure

Adopts both remediations from CB-EV-0001 §4 (maintainer decision).

Option A — serde_yaml is now optional behind cb-game-runtime's
`scenarios` feature. The scenario module, the ScenarioGame impl and the
string parsers behind it are cfg-gated; cb-sim opts in explicitly. Both
configurations compile and lint clean under -D warnings.

A trap worth recording: `default-features = false` on a *member*
dependency is silently ignored when the workspace dependency does not
specify it. The first attempt gated nothing while looking correct — the
build succeeded and cargo tree still showed all six YAML crates. Fixed
by setting it on the workspace dependency. This is the positive-control
failure mode in miniature: success was not evidence the change applied.

Retarget — AM-4 now measures third-party source under audit, split by
build configuration, replacing a crate count that was unreachable
without undoing K5/K7 and that does not compare across ecosystems.

Re-measured via the new `make dep-weight`, whose own positive control
refuses to report when any crate's source cannot be located:

  shipped runtime   23 crates   246,250 lines   target <=250,000  met
  dev toolchain     29 crates   317,021 lines   target <=350,000  met
  own source                      3,408 lines

Scenario tooling costs 70,771 lines a shipped game never compiles —
the split the single number was hiding.

Targets are set at current measurement plus headroom, so they bind on
future growth rather than retroactively passing what had failed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

specs/GameKernel.md

@@ -26,8 +26,16 @@ and must never leak types into anything specified here (M-D4-LEAK = 0).
 Dependency rule: `games/ground → cb-game-runtime → cb-events → cb-kernel`.
 No cycle, no skip that bypasses a public API. External crates allowed in
 the headless kernel workspace: serde (+format crate), a seedable RNG
-(e.g. chacha), a hash (sha2), thiserror-class error derive — target total
-transitive crates ≤ 20 (AM-4).
+(e.g. chacha), a hash (sha2), thiserror-class error derive. Weight is
+budgeted as **third-party source under audit**, split by build
+configuration — see AM-4.
+
+**Scenario parsing is dev-only.** `cb-game-runtime`'s `scenarios` feature
+carries the YAML dependency; a shipped game runtime builds with
+`--no-default-features` and parses no YAML. Workspace dependencies on
+`cb-game-runtime` and `games-ground` therefore set
+`default-features = false`, and consumers that need scenarios (currently
+`cb-sim`) opt in explicitly.
 
 ## 2. Canonical model
 
@@ -125,7 +133,23 @@ Command (actor-tagged intent)
 
 ---
 
-## 4. Acceptance metrics (the code loop's exit condition)
+## 4. Acceptance metrics
+
+**On AM-4's retarget (2026-07-31).** AM-4 originally read "≤20
+transitive crates", set against boardgame.io's 120 npm packages. That
+target was retired for two measured reasons. First, it was unreachable
+without undoing this spec's own contracts: K5 (seeded ChaCha) and K7
+(SHA-256) cost 12 crates between them, and the measured ladder showed
+nothing reached 20 except reimplementing one of those primitives —
+which trades an audited implementation for a scoreboard number. Second,
+crate count does not compare across ecosystems: Rust splits crates far
+more finely than npm, so the original 33-vs-120 comparison flattered us
+while the ≤20 target punished us, both for the same reason.
+
+Third-party source under audit is what the count was a proxy for, it is
+comparable across ecosystems, and it cannot be gamed by crate
+granularity. Splitting it by build configuration also makes the
+dev/shipped distinction visible, which the single number hid. (the code loop's exit condition)
 
 Per InnerLoop step 4/5: T08 iterates until every row meets its target;
 evidence lands in `evidence/CB-EV-0001-game-kernel.md` with no
@@ -136,7 +160,9 @@ evidence lands in `evidence/CB-EV-0001-game-kernel.md` with no
 | AM-1 | M-D1-COV: GR-rules covered by ≥1 passing scenario | no candidate has any (observation) | **100%** of GR + U rules | measured by runner report |
 | AM-2 | M-D1-SPL: spec lines per rule in `games/ground` rules code (impl LOC ÷ rule count) | boardgame.io ~36 LOC for the 2-move synthetic game | ≤ 40 LOC/rule, paired with AM-1 (anti-gaming pair) | measured (tokei + rule count) |
 | AM-3 | Synthetic-workload definition size: LOC to express the CB-RES-0001 synthetic game on our kernel | ~36 LOC (boardgame.io, measured) | ≤ 50 LOC | measured |
-| AM-4 | M-D2-DEP: transitive crates, headless workspace | 120 npm packages | **≤ 20** | measured (cargo tree) |
+| AM-4a | M-D2-DEP: third-party LOC, **shipped runtime** (`--no-default-features`) | boardgame.io: 120 npm packages / 3.9M LOC | **≤ 250,000 lines** | measured (`make dep-weight`) |
+| AM-4b | M-D2-DEP: third-party LOC, **dev toolchain** (default features) | as above | **≤ 350,000 lines** | measured (`make dep-weight`) |
+| AM-4c | M-D2-DEP: own source per third-party 100k lines | — | reported, not targeted | measured (`make dep-weight`) |
 | AM-5 | M-D2-BLD: clean release build of headless workspace | n/a (npm install ~seconds; not comparable) | ≤ 60 s on bnt-lap001, recorded not gated | measured |
 | AM-6 | M-D3-THR: applied events/s, synthetic workload, same machine | boardgame.io ~1,100–1,900 moves/s (best config, degrading) | **≥ 100,000/s** (stipulated target, ADR-0002) | measured |
 | AM-7 | M-D3 scaling: throughput @100k events vs @5k; and snapshot+replay of 100k events | boardgame.io 0.45–0.66× @20–40k, DNF @100k | **≥ 0.9×** (flat), replay of 100k events ≤ 5 s, hash-identical | measured |