test: add static weak-assertion lint for attacker procedures

[eastmadc]

The attacker agent writes the exploit and the assertions that grade it. Nothing
currently checks that those assertions can tell a working exploit from a broken
one — an expect of status: 200, or a body_contains that also matches the
error page, passes a procedure that proves nothing, green, in CI, forever.

This is the static half. It reads procedure YAML and reports assertion shapes
that cannot discriminate:

	rules
errors	no_expect on the final step, status_only_2xx across a whole procedure, exec_target_in_procedure, unparsed
warnings	generic_text, short_text, tautological, no_dynamic_evidence, unused_output

Calibrated against your own fixtures. My first pass errored on 4 of 5 and
almost all were false positives — stdout_contains: root after whoami is a
strong assertion, and a step that posts a payload and asserts 201 is fine when a
later step verifies it fired. So the generic-word rule now skips command output,
and status-only is judged per procedure rather than per step. Six of the eight
fixtures are now clean.

The two that still error are exec_and_listen.yaml and step_chaining.yaml,
both using exec_target. Their headers say "god-view", so that's correct for an
executor fixture — but goe/models/procedure.py says it's "never in L2
procedures", so it's a real bug in a generated one. I've left the rule as an
error; happy to downgrade it or exclude fixtures if you'd rather.

No Docker, no model calls — runs under the standard contributor check. 16 tests,
every rule covered in both directions. Standalone:

python -m goe.eval.procedure_lint tests/fixtures/procedures/

The half that isn't here: the dynamic negative control — build each entity
with the vulnerability suppressed, run the same procedure, require it to fail. A
procedure that passes both targets is vacuous. That needs the executor and a
baseline fixture, so it's not in this PR, but it's the version with teeth and I'm
happy to draft it if you're interested.