feat(config): every lens off until the repository turns it on

Jorijn: "all lenses off by default and opt in only". Config::Defaults()
gives every lens run: false; a config that turns on none - a missing
`lenses` key included - has the one problem that names the lenses, so
config, freeze and run all stop on it; the template ships every lens off,
init says to turn lenses on, and the "no lens runs" preflight names the
cause. A consumer config without a `lenses` key now needs one, as the CI
smoke test's does.

Proven with the lens commit before it: the suite (26 passed), and the
dry-run comparison recorded there.

process/prepush.md

@@ -6,7 +6,8 @@ the pull request it opens) is the next release. The `/prepush` skill drives
 this file. The mechanics: freeze → hash → gates → the owner; five lenses,
 the functional one as Gate 2 (Jorijn, 2026-10-15), the security lens beside
 the bug-prover in Gate 3 (2026-10-22), the commit-truth lens as Gate 4
-(2026-10-31).
+(2026-10-31), every one of them off until the repository's config turns it
+on (2026-10-31).
 
 Nothing is pushed without the owner's explicit approval of the exact frozen
 hash. Local commits parked unpushed are fine and normal.
@@ -136,7 +137,9 @@ freeze accepts; null = `git config user.email`), `aiTrailers` (`forbid` or
 `allow`), `requireSigned`, `allowDirty` (tracked
 files the local stack rewrites in place while the lenses run), `gate0` (the
 commands Gate 0 runs by hand, for the skill), `lenses` (per lens, by its
-name: `run` — `false` leaves the lens out of every run of this repository:
+name: `run` — every lens is off until it is `true` here (opt-in only,
+2026-10-31); a lens the config does not turn on is out of every run of this
+repository:
 its gate disappears, the units only it reads are listed as not reviewed,
 never as holes, and the run stays a full run; the ruling of record for a
 repository with nothing to exercise, where `--without` is a per-run ruling
@@ -308,7 +311,8 @@ diffstats — and the units of documentation files (`*.md`), each
 heading-delimited part of a hunk on its own, and it asks `whole:order` and
 `whole:absent` in slot passes of its own; a documentation file's diff header
 and a part the commit writes nothing in are a mechanical `n/a`. A lens the
-config turns off (`lenses.<name>.run = false`) reads nothing: the units only it would have read (its whole slot —
+config leaves off (every lens is off until `lenses.<name>.run = true`) reads
+nothing: the units only it would have read (its whole slot —
 `whole:behaviour` for the functional lens; the prose for the commit-truth
 lens) are listed under `coverage.notReviewed`, never as holes, and the
 summary says so. The functional lens plans no pass on a diff header, on a
@@ -606,6 +610,10 @@ repository.
   5-hour column. Then (Jorijn: "there is no need to do a global cap anymore,
   the cap should be 128 per available account") the machine-wide width
   went: `--concurrency` caps only when given.
-- 2026-10-31 — **the commit-truth lens as Gate 4** (Jorijn: "fix that in
-  Crafter.Review"). The owner's gate is 5. Its firing proof in this pipeline
-  is owed (the owner's go).
+- 2026-10-31 — **every lens off by default, opt-in only; the commit-truth
+  lens as Gate 4** (Jorijn: "make it so all lenses are off by default and
+  it's opt in only"; and of the commit-truth lens, "fix that in
+  Crafter.Review"). A config that
+  turns on no lens is a problem `config` names and `freeze` and `run` stop
+  on; `init` says to turn lenses on; the owner's gate is 5. The commit-truth
+  lens's firing proof in this pipeline is owed (the owner's go).