Add run records, step state machine, verification and exercise-status diff (RBT-WP-0003)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 295952@bnt-lap001
Assistant-Session: e93f64ad-516c-46eb-9666-aad8d300c477

docs/run-spec.md

@@ -0,0 +1,26 @@
+# Run record `runbook-run/v0.1`
+
+One run of one native pack, stored as JSON in
+`<owning repo>/.local/runbook-runs/<run_id>.json` (git-ignored). Non-secret only.
+
+| Field | Meaning |
+| --- | --- |
+| `run_id` | Timestamp plus random suffix |
+| `pack_id`, `pack_path` | The pack run |
+| `operator` | One word: the person who ran it |
+| `params` | Resolved parameter values (validated, never secret) |
+| `steps.<id>.state` | `todo`, `running`, `done`, `failed`, `skipped` |
+| `steps.<id>.verification` | `kind`, `passed`, and for commands `exit_code`, `output_bytes`, `seconds`. Output text is never stored |
+| `steps.<id>.evidence` | The facts the step declared, supplied by the operator |
+
+## Rules
+
+- Steps run in order; a step starts only after its predecessors are done or skipped.
+- A step completes only with a passing verification and its declared evidence.
+- A verify command runs only when the operator confirms (`--yes`), with a 60 s timeout.
+- Only read-only steps may be skipped, and a run with skips never exercises a pack.
+- Values matching the secret markers are refused everywhere they could be recorded.
+- The engine never edits `pack.yaml`. `rtut run finish` shows the exercise-status
+  diff; `--apply` writes it, and only for a run in which every step is done.
+
+CLI: `rtut run new|list|status|cmd|start|verify|done|fail|retry|skip|finish <pack.yaml> ...`