feat(grasp-audit): add filter capability compliance tests

Add comprehensive GRASP-01 compliance tests for uploadpack.allowFilter
capability to the grasp-audit test suite. These tests can be run against
ANY GRASP implementation (ngit-relay, ngit-grasp, or others) to verify
filter support.

New test module: grasp-audit/src/specs/grasp01/git_filter.rs

Tests added:
- test_filter_capability_advertised: Verifies filter appears in info/refs
- test_filtered_clone_succeeds: Tests git clone --filter=blob:none
- test_filtered_fetch_succeeds: Tests git fetch --filter=tree:0

Usage:
  cd grasp-audit && nix develop -c bash test-ngit-relay.sh --mode test
  cd grasp-audit && nix develop -c cargo run -- audit -r ws://localhost:8080 -s git-filter

1 files changed, 11 insertions, 2 deletions

diff --git a/grasp-audit/src/bin/grasp-audit.rs b/grasp-audit/src/bin/grasp-audit.rs
index 08a92c7..99e3c35 100644
--- a/grasp-audit/src/bin/grasp-audit.rs
+++ b/grasp-audit/src/bin/grasp-audit.rs
@@ -27,7 +27,7 @@ enum Commands {
         #[arg(short, long, default_value = "shared")]
         mode: String,
 
-        /// Spec to test (nip01-smoke, nip11, event-acceptance, cors, git-clone, push-auth, repo-creation, all)
+        /// Spec to test (nip01-smoke, nip11, event-acceptance, cors, git-clone, git-filter, push-auth, repo-creation, all)
         #[arg(short, long, default_value = "all")]
         spec: String,
 
@@ -124,6 +124,10 @@ async fn main() -> Result<()> {
                     println!("Running Git clone tests...\n");
                     specs::GitCloneTests::run_all(&client, &relay_domain).await
                 }
+                "git-filter" => {
+                    println!("Running Git filter capability tests...\n");
+                    specs::GitFilterTests::run_all(&client, &relay_domain).await
+                }
                 "push-auth" => {
                     println!("Running push authorization tests...\n");
                     specs::PushAuthorizationTests::run_all(&client, &relay_domain).await
@@ -146,6 +150,11 @@ async fn main() -> Result<()> {
                     let clone_results = specs::GitCloneTests::run_all(&client, &relay_domain).await;
                     all_results.merge(clone_results);
 
+                    // Git filter capability tests
+                    println!("  → Git filter capability tests...");
+                    let filter_results = specs::GitFilterTests::run_all(&client, &relay_domain).await;
+                    all_results.merge(filter_results);
+
                     // Push authorization tests
                     println!("  → Push authorization tests...");
                     let push_results = specs::PushAuthorizationTests::run_all(&client, &relay_domain).await;
@@ -176,7 +185,7 @@ async fn main() -> Result<()> {
                 }
                 _ => {
                     return Err(anyhow!(
-                        "Unknown spec: {}. Use 'nip01-smoke', 'nip11', 'event-acceptance', 'cors', 'git-clone', 'push-auth', 'repo-creation', or 'all'",
+                        "Unknown spec: {}. Use 'nip01-smoke', 'nip11', 'event-acceptance', 'cors', 'git-clone', 'git-filter', 'push-auth', 'repo-creation', or 'all'",
                         spec
                     ))
                 }