Only-t27 gate: a foreign-line budget the label cannot lift; local hook reads exceptions from origin/master #7371

Owner order 2026-10-07 (translated): "set lefthook up so it slaps the idiots' hands", after R3-1's tool half (#7363) landed ~800 hand-written Rust lines of new logic in bootstrap/src/service.rs.

Problem

The Only-t27 gate (specs/policy/own_language.t27) has three holes that let an agent ship a whole foreign-language feature:

1. Locally, the exception list is read from the working tree. An agent adds its own path to tools/policy/foreign-exceptions.txt in the same branch and the hook passes. (verified: t27c signs receipts and run-record judges their level -- R3-1 tool half (Closes #7332) #7363 did exactly this.)
2. In CI the label owner-approved-foreign skips the whole check, and the label is applied through the same gHashTag account the agents use. GitHub cannot tell the owner from an agent, so the label gates nothing. (verified: t27c signs receipts and run-record judges their level -- R3-1 tool half (Closes #7332) #7363's label: actor gHashTag, applied by the agent.)
3. An exception is a whole file. Once bootstrap/src/service.rs is listed, any number of new lines pass.

Requirement

• A foreign-line budget in own_language.t27: at most FOREIGN_ADDED_MAX (40) added lines per hand-written foreign file and FOREIGN_ADDED_TOTAL_MAX (80) per diff, read from git diff --numstat --no-renames. Exceptions and the label do not lift it. Deletions are free. Generated roots and .t27 are exempt.
• lefthook pre-commit/pre-push: the exception list comes from origin/master in --ci mode (a branch cannot list itself), plus the budget command.
• CI: the budget step runs whether or not the label is set, compiled from the BASE revision's generated gate when BASE has it (a PR cannot loosen its own budget).

Acceptance

• spec tests pass on the lab (zig), hand mutants of the budget killed, gen/c regenerated
• a negative control: verified: t27c signs receipts and run-record judges their level -- R3-1 tool half (Closes #7332) #7363's diff (service.rs +804) is DENIED by the budget even with the exception entry present
• this PR's own foreign additions (lefthook.yml, own-language.yml) are under the budget