chore: update dewey scaffolding and constitution for unbound-force v0.16.0

[yvonnedevlinrh]

Summary

Update the dewey repo to align with unbound-force v0.16.0. uf init --force handles the bulk of the work — this issue tracks that step plus the manual follow-ups init cannot touch.

Tasks

1. Run uf init --force

This single command handles ~80% of the update:

• Overwrites all tool-owned files with v0.16.0 content (commands, skills, canonical convention packs, OpenSpec schemas,
  Speckit framework)
• Stamps v0.16.0 version markers (replacing vdev)
• Updates skills in .opencode/skills/ (15 currently; 4 are scaffolded tool-owned, rest are repo-specific user-owned)
• Refreshes DCP config (.opencode/dcp.jsonc)
• Cleans up legacy command names (pre-uf. namespace prefix)
• Re-initializes sub-tools (Specify, OpenSpec)

2. Constitution alignment (manual — NEVER-OVERWRITE)

.specify/memory/constitution.md is protected from --force.
Manual updates required:

• Bump parent_constitution reference from v1.1.0 → v1.2.0
• Add Principle V: Security by Default section aligned with org constitution v1.2.0
• Review existing 4 principles for any conflicts with org v1.2.0 wording
• Bump constitution version (currently v1.4.0)

3. Add permission gates to opencode.json

The org repo now enforces granular bash permissions (#477, #493).
Dewey currently has no permission gates. Add:

• gh issue / gh pr mutation gates
• git push gate
• rm safety gate
• Any dewey-specific sensitive operations

4. CI action pin audit

Review .github/workflows/ci.yml, mega-linter.yml, and release.yml for stale action SHAs. Verify alignment with org-level pins:

• actions/checkout → v7.0.1 SHA
• actions/setup-go → v7.0.0 SHA
• org-infra reusable workflows → latest SHA

5. Verify stale agent refs

After init, check user-owned agent files (18 files including full Divisor council, Gaze variants, Cobalt-Crush, Mx F) for references to old command names (pre-uf. prefix). Init warns but does not auto-fix these.

Context

Release: https://github.com/unbound-force/unbound-force/releases/tag/v0.16.0
Current constitution: v1.4.0 (parent ref: org v1.1.0)