Add spec suite gate to PR CI

[imaurer]

Summary

• Adds a new spec job to .github/workflows/ci.yml that builds target/release/biomcp via cargo build --release --locked and then runs make spec
• Removes the stale statement in analysis/technical/overview.md that said no GitHub workflow runs make spec; updates the doc to describe the five-job PR CI surface
• Extends tests/test_upstream_planning_analysis_docs.py with assertions that guard the five-job CI inventory and the exact spec job run steps, so CI docs and workflow stay in sync

Why

The BioMCP spec suite is the repo's executable CLI contract documentation, but no PR CI job ran it. A failing spec could go undetected until a manual local run. This change closes that gap so spec regressions fail in CI before review.

Notes

• The Makefile already prepends target/release to PATH so make spec uses the freshly built binary rather than the potentially stale editable .venv/bin/biomcp install
• Tests gated on OPENFDA_API_KEY are skipped in CI via spec/conftest.py — no secrets required in the new job