Capsem Just discipline

The Justfile is a product interface, not a script drawer. Its public surface is exactly the allowlist in config/public-surface.toml; the contract test derives the live recipe list and fails on additions, removals, renames, or count drift. A new public recipe requires explicit user/product approval and an intentional allowlist update in the same change.

Approved public commands