OpenRewrite as Remediation Layer

OpenRewrite is not just another enforcement tool — it is the remediation layer. Each Spec that can be auto-fixed references an OpenRewrite recipe alongside its enforcement tools, so developers see both "what's wrong" and "how to fix it" in one place.

Considered options: - Treat OpenRewrite as another enforcement tool in tools[] — loses the distinction between "detect" and "fix". - Separate repo for OpenRewrite recipes — fragments the Spec into two places with no cross-reference. - Hybrid: Spec metadata points to both enforcement tools and remediation recipes — unified view.

Consequences: - Spec front-matter gains a remediation field (recipe ID), keeping detection and fix co-located. - CI/CD can run OpenRewrite in --dry-run mode during PR checks to show proposed fixes without applying them. - Developers can run mvn rewrite:run -DactiveRecipe=<recipe> locally to auto-fix, reducing manual toil.