1.0 prep: precedence, lazy dynamic vars, export:false end-to-end

[clintmod]

Goal

Close three behavioral gaps where SPEC says one thing and the tests don't prove it end-to-end.

Tasks

• Fixture testdata/precedence_shell_vs_cli/ — SPEC's worked example: VAR=shell rite task VAR=cli → shell wins (tier 1 beats tier 2)
• Fixture testdata/export_false/ — task has vars: with export: false, cmds: runs env | grep VAR and asserts the var is absent from the shell env but still usable in {{.VAR}}
• Fixture testdata/lazy_dynamic/ — Ritefile with an expensive sh: in a non-invoked task (e.g. sh: touch /tmp/rite_lazy_sentinel && echo x); after running an unrelated task, assert sentinel doesn't exist
• New file internal/task/spec_behaviors_test.go wiring these three

Parallel-safety

Only creates new fixture dirs and a new _test.go file. No overlap with the scope-isolation stream or the experiment-flag cleanup stream.

Part of the 1.0 readiness audit.

[clintmod]

Filed against the wrong repo — refiling on clintmod/rite. Apologies for the noise.