chore: harden SDD governance workflow

scripts/verify-openspec-version.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)
+contract_file=${1:-"$script_dir/../openspec/.cli-version"}
+
+if [[ ! -f "$contract_file" ]]; then
+  printf 'OpenSpec version contract is missing: %s\n' "$contract_file" >&2
+  exit 1
+fi
+
+expected_version=$(tr -d '[:space:]' < "$contract_file")
+if [[ -z "$expected_version" ]]; then
+  printf 'OpenSpec version contract is empty: %s\n' "$contract_file" >&2
+  exit 1
+fi
+
+if ! command -v openspec >/dev/null 2>&1; then
+  printf 'OpenSpec CLI %s is required, but openspec is not available in PATH.\n' "$expected_version" >&2
+  exit 1
+fi
+
+actual_version=$(openspec --version 2>/dev/null | tr -d '\r\n')
+if [[ "$actual_version" != "$expected_version" ]]; then
+  printf 'Unsupported OpenSpec CLI version: expected %s, actual %s.\n' "$expected_version" "${actual_version:-unknown}" >&2
+  exit 1
+fi
+
+printf 'OpenSpec CLI version verified: %s\n' "$actual_version"