Multi-source verification targets

[markmals]

Summary

A target's source in .speckit/specs.json may now be a single directory string (unchanged) or a JSON array of directories. Verification scans every listed root and joins the bindings into one target — so a Go-service target whose scenario tests span the daemon, shared internal/ packages, and a sibling CLI can be verified as one unit.

Fixes the Trove handoff repro:

specify: .speckit/specs.json: json: cannot unmarshal array into Go struct field Target.targets.source of type string

What changed

• config.SourcePaths — a []string that JSON-decodes from a string or an array; ergonomic round-trip (one path → bare string, many → array) so existing single-source configs don't churn. Validation requires ≥1 non-empty path.
• Engine — VerifyConfig.Source is now []string; new additive ScanBindingsMany / ScanDeviationsMany aggregate across roots; verify and parity route through them. Binding identity/file/line, bindings: "scoped", dangling-from-any-root, and locking semantics are all unchanged (they operate on the joined binding set).
• CLI — verify/parity work with multi-source targets; specify target register --source is now repeatable for authoring them without hand-editing JSON. deploy/secrets use the first source for their app-dir heuristic.
• Docs — docs/config.md documents the array form; design doc at docs/design/multi-source-targets.md.

The config↔engine boundary is preserved: the flexible JSON lives only in config; the engine stays a plain []string; the CLI is the sole glue.

Test Plan

• mise run ci green (build + vet + test + gofmt), including after merging latest main
• Config: loads legacy string + array source; validation rejects missing/empty-array/blank entries; ergonomic marshal round-trip
• Engine: verify joins bindings from two roots → both pass + lock; dangling binding from either root fails; scoped drops untagged across the joined set; missing-root tolerance pinned
• CLI: target register with repeated --source writes an array target