Convert harness scan.rs to read the linkme registry (unify source of truth)

[schgoo]

Problem

Operation metadata is encoded twice, risking drift:

1. The linkme registry (specgate-runtime): the #[spec_operation]/#[spec_setup] macros register OpMeta { name, module_path, fn_name, is_setup, is_async, params, return_type, fills }, and the SpecEvent derive knows each type's fields/variants (it parses them via syn to generate emit_fields/to_spec_value).
2. scan.rs (specgate-harness): string-parses the same operation signatures, setups, and SpecEvent type names out of the raw source text.

The harness uses scan.rs for wiring/codegen (setup resolution, method receivers, etc.), but everything it extracts is already available — compiler-accurate — in the registry.

Proposal

Convert the harness to read the linkme registry (via a discovery build) instead of string-parsing source in scan.rs. Single source of truth, no drift, and it removes a fragile hand-rolled parser.

This becomes natural after the extraction feature (#24-adjacent) enriches the registry: extraction needs full operation signatures + type field/variant shapes in the registry, which is most of what scan provides. Once OpMeta.params is serialized and TypeMeta carries fields/variants, scan is largely redundant.

Needs

• The registry is populated at link time, so the harness must build+run a discovery step to read it (it already does this kind of scaffolding for the runner). Decide whether wiring resolution (resolve_case, setup/receiver matching) moves onto registry data.
• Keep behavior identical: the harness self-host spec (75 cases) and fixture suite must stay green through the conversion.

Context

Raised while designing registry-based spec extraction (implementation → spec). Extraction reads the registry rather than re-parsing source; the same registry can back the harness.