chore: bump spec-spine to 0.10.0 and regenerate .derived

[bartekus]

chore: bump spec-spine 0.8.0 to 0.10.0

Updates the pinned spec-spine governance toolchain (the dogfood dependency) to the
latest release, 0.10.0.

What changed

• package.json: devDependency pin 0.8.0 to 0.10.0 (exact, per the one-pin model).
• package-lock.json: regenerated (spec-spine plus its five @spec-spine/cli-*
  platform packages).
• .derived/codebase-index/by-package/tenant-tail-{cli,core,types}.json: regenerated
  under 0.10.0. Only the shardHash changed in each; schemaVersion stays 1.1.0,
  so there is no format migration. 0.10.0 folds the workspace-resolved crate version
  (0.3.0, via version.workspace = true) into the crate shard hash, which 0.8.0 did
  not capture. The spec-registry and all other index shards are byte-identical.

Testing

npm install clean (0 vulnerabilities); spec-spine compile (0 warnings),
index check (fresh), lint --fail-on-warn (0/0/0). Index regeneration is
idempotent (identical shard hashes on re-run). CI's determinism golden re-verifies
byte-identical .derived across all four triples under 0.10.0.

[github-actions]

AI Code Review

Review: spec-spine 0.8.0 → 0.10.0 bump

Potential Issue: Asymmetric .derived/ Regeneration

All three codebase-index/by-package/*.json shards changed, but no spec-registry/by-spec/*.json shards appear in the diff. If spec-spine 0.10.0 changed only its indexer (not the compiler), this is fine. If it also changed the compiler schema, the spec-registry shards should have changed too.

Risk: spec-spine index check compares committed artifacts to a fresh run. If the spec-registry shards are stale relative to 0.10.0's compiler output, the self_governance CI job will catch it — but if it doesn't catch it, the coupling gate is running against partially-stale data.

Action: Confirm spec-spine compile && spec-spine index check passes cleanly with 0.10.0 locally. If spec-registry shards should have changed, they need to be included in this PR.

Minor: Version Skip (0.8.0 → 0.10.0)

Jumping a full minor version (0.9.x absent) without a visible changelog. In a 0.x semver series, minor bumps can carry schema-breaking changes. The diff gives no evidence of what 0.9.x → 0.10.0 changed. This is low risk since spec-spine is a devDependency (no runtime surface), but the reviewer should know whether 0.10.0 contains schema changes that require spec content updates.

No Issues Found

• package-lock.json integrity hashes use correct sha512- format.
• No source code changes are present, so no coupling-gate obligations on spec ownership.
• No network surface added; no signing keys introduced; hard invariants appear intact.
• The [package.metadata.tenant-tail].spec annotations in the codebase-index files are unchanged, which is correct (the specs themselves didn't change).

---

Automated review by Claude. Diff size: 28 lines.