Worktree spike binary preflight

[v0lkan]

What started as "fail fast when SPIRE binaries are missing" turned into
a chain of finds, each surfaced by the previous fix letting make start
run further. The branch hardens the bare-metal startup path end to end
and fixes a real regression in Nexus that made spike policy get and
spike policy delete unusable.

The make start preflight (bare-metal harness)

• SPIRE binaries (a70c80b, 861c86c, 526ee14): start.sh now
  checks for spire-server/spire-agent on PATH up front and points
  at the new make build-spire target instead of failing mid-run with
  a bare "command not found". build-spire.sh clones into a temp
  directory and cleans up after itself (the leftover ./spire clone
  used to break make audit).
• SPIKE binaries (d683ce8): the same treatment for spike,
  nexus, keeper, bootstrap, and demo. The check runs right
  after the build step (on a fresh clone the binaries do not exist
  earlier) and fails with concrete guidance: make build, a
  copy-pasteable export PATH line, and a verify command.
• PATH shadowing (314ae6e): the binary names are generic enough
  to collide with tools already on PATH, and the docs recommend
  appending the repo's bin to PATH, so an existing lookalike wins
  silently. Because the SPIRE entries pin the exact binary path and
  hash (unix:path, unix:sha256), a shadowed binary cannot obtain an
  identity and the run fails later in confusing ways. The preflight now
  verifies each name resolves to ./bin/<name> (same-file test, so
  symlinks are fine) and fails fast naming the conflicting paths. When
  SPIKE_SKIP_REGISTER_ENTRIES is set the entries may legitimately
  point elsewhere, so the mismatch downgrades to a warning.

Keeping PATH-based invocation is deliberate: binaries on PATH are the
user-facing convenience, and the harness sharing that resolution keeps
one consistent story. The preflight only makes the failure modes loud.

The policy regression (Nexus)

0971260 — since #292 policies are keyed solely by name, and the ID
field of PolicyReadRequest/PolicyDeleteRequest carries the policy
name (the route handlers already treat it that way). The request
guards, however, still validated that field with
net.RespondErrOnBadPolicyID, which enforces UUID format, so every
spike policy get <name> and spike policy delete <name> came back
"400 Bad Request" before reaching its handler. The guards now use
net.RespondErrOnBadName, the same validator the put guard applies on
create. Validation stays in force; only the enforced format changes.

Cleanups the regression hunt surfaced

• 837e0db (pilot): the human formatters for spike policy list and spike policy get printed a vestigial ID: line, always empty since feat(policy): use name as the sole policy identifier #292. Removed, tests updated, and the stale list doc example
  rewritten (it showed fields the list endpoint never returns).
• 7795eea (harness): the policy checks in start.sh grepped for
  output formats that predate both fix: Standardize output format options across all CLI commands #274 and feat(policy): use name as the sole policy identifier #292 (tabular ID NAME
  header, Permissions: lines that list never prints). They failed
  on every run, masked by the debug-mode "continuing anyway" path. The
  validation now expects Name: <policy> blocks from list and
  verifies permissions through spike policy get, which also exercises
  the fixed get-by-name path end to end.

Testing

• Full make audit and make test pass on every commit.
• The preflight functions were exercised directly in all paths:
  missing binaries, shadowed binaries (fatal and warn variants), and
  clean pass.
• The get-by-name regression was reproduced against a live bare-metal
  environment (Error: Invalid request.) before the fix.

Follow-ups (not in this PR)

• SDK issue Simplify policy identification: use name as primary identifier; remove ID from policies #250: rename the ID field to Name in policy request/response types; the empty "id" in JSON/YAML output goes
  away with it. - The sqlite state tests use the real ~/.spike/data/spike.db and
  delete it, which breaks a concurrently running bare-metal environment (and vice versa). They should use t.TempDir().