chore: update replicator scaffolding and constitution for unbound-force v0.16.0

[yvonnedevlinrh]

Summary

Update the replicator repo to align with unbound-force v0.16.0. uf init --force handles the bulk of the work — this issue tracks that step plus the manual follow-ups init cannot touch.

Tasks

1. Run uf init --force

This single command handles ~80% of the update:

• Overwrites all tool-owned files with v0.16.0 content (commands, skills, canonical convention packs, OpenSpec schemas, Speckit framework)
• Stamps v0.16.0 version markers (replacing vdev)
• Deploys new/updated skills (always-on-guidance, pre-flight, review-context, speckit-workflow)
• Refreshes DCP config (.opencode/dcp.jsonc)
• Cleans up legacy command names (pre-uf. namespace prefix)
• Re-initializes sub-tools (Dewey, Specify, OpenSpec, Gaze)

2. Constitution alignment (manual — NEVER-OVERWRITE) .specify/memory/constitution.md is protected from --force.

Manual updates required:

• Bump parent_constitution reference from v1.1.0 → v1.2.0
• Add Principle V: Security by Default section aligned with org constitution v1.2.0
• Review existing 4 principles for any conflicts with org v1.2.0 wording
• Bump constitution version (currently v1.0.0)

3. Add permission gates to opencode.json

The org repo now enforces granular bash permissions (#477, #493). Replicator currently has no permission gates. Add:

• gh issue / gh pr mutation gates
• git push gate
• rm safety gate
• Any replicator-specific sensitive operations

4. CI action pin audit

Review .github/workflows/ci.yml and release.yml for stale action SHAs. Verify alignment with org-level pins:

• actions/checkout → v7.0.1 SHA
• actions/setup-go → v7.0.0 SHA
• org-infra reusable workflows → latest SHA

5. Verify stale agent refs

After init, check user-owned agent files in .opencode/agents/ for references to old command names (pre-uf. prefix). Init warns but does not auto-fix these.

Context

Release: https://github.com/unbound-force/unbound-force/releases/tag/v0.16.0
Current constitution: v1.0.0 (parent ref: org v1.1.0)