docs(specs): update specs for post-v0.6.0 security and type-safety hardening

[bug-ops]

Summary

Brings specs/ up to date with what shipped in v0.6.0..main, after reviewing every merged commit in that range:

• specs/001-security-pipeline/spec.md: adds FR-019 and updates NFR-002 to document the component-aware, case-folded paths_start_with fix on macOS/Windows (GHSA-wcmx-7f9h-5mv5, fix(core): use component-aware comparison in macOS/Windows containment check #543), plus a dated callout and an edge-case row. Also adds a callout summarizing the SanitizedMode/#[non_exhaustive] hardening (core: SanitizedMode newtype and non_exhaustive on growth-prone enums #554) with a pointer to the new spec below.
• specs/016-sanitized-mode-and-non-exhaustive-enums/spec.md (new): retrospective spec, following the same pattern as 013-quota-permit-capability-token and 014-config-typestate-validation, documenting the SanitizedMode sealed newtype (closes core: sanitized permission mode passed as raw u32 with 'caller must sanitize' contract #549) and the six enums (ArchiveError, QuotaResource, ArchiveType, CompressionCodec, IssueCategory, types::entry_type::EntryType) marked #[non_exhaustive] (closes core: several growth-prone public enums missing #[non_exhaustive] #551), including the wildcard-arm updates required in exarch-cli/exarch-python/exarch-node.
• specs/005-cli/spec.md: adds FR-087, a Verbosity Data Model entry, and an edge-case row documenting the --verbose/--quiet boolean-blindness fix (cli: unlabeled bool params in output formatter constructors (json/verbose/quiet) #550) — including the split-level clap ArgMatches bug it closes (a global --verbose combined with a subcommand-level --quiet bypassed conflicts_with and previously resolved inconsistently between the formatter and the progress reporter).
• specs/MOC-specs.md: adds the new spec 016 to the index.

Commits reviewed but intentionally left undocumented (routine, no architectural/behavioral shift):

• MSRV bump to 1.98.0 + Path::is_empty() migration (core: track stable Rust APIs above MSRV 1.96 for a future bundled bump #558/build!: bump MSRV to 1.98.0 and replace as_os_str().is_empty() with Path::is_empty() #562) — already reflected in spec MSRV headers, which already said 1.98.0
• sevenz-rust2 bumps (chore(deps): bump sevenz-rust2 from 0.21.5 to 0.22.2 #561, build: bump sevenz-rust2 to 0.21.5 #552) and the flate2/napi minor-patch bump (chore(deps): bump the minor-and-patch group with 2 updates #560) — forward-looking hardening / no observable behavior change per their own changelog entries
• GitHub Actions install-action bumps (chore: bump taiki-e/install-action from 2.86.5 to 2.87.0 #559, chore: bump taiki-e/install-action from 2.85.13 to 2.86.5 #555, chore: bump taiki-e/install-action from 2.85.10 to 2.85.13 #545, chore: bump taiki-e/install-action from 2.85.5 to 2.85.10 #541) and other dependency-group bumps (chore(deps): bump the minor-and-patch group with 5 updates #547, chore: bump lewagon/wait-on-check-action from 1.9.0 to 1.9.1 #546, chore(deps): bump the minor-and-patch group with 3 updates #542) — routine CI/dependency noise
• TempOrphanRef refactor deduping orphan-disclosure args (refactor(cli): dedupe orphan-disclosure args in atomic-force extraction #544) — explicitly "no behavior change" per its own commit message and changelog entry; no spec described the exact parameter list it simplifies

Test plan

• Reviewed git log v0.6.0..origin/main --stat and the full diff of each non-routine commit (fix(core): use component-aware comparison in macOS/Windows containment check #543, refactor(cli): dedupe orphan-disclosure args in atomic-force extraction #544, refactor(cli): replace verbose/quiet bool pairs with Verbosity enum #553, core: SanitizedMode newtype and non_exhaustive on growth-prone enums #554)
• Cross-checked existing specs (001-security-pipeline, 005-cli, 013, 014, 015) for prior coverage before adding new content
• N/A — documentation-only change, no code touched

https://claude.ai/code/session_01P7y9J9CVJ7NosUvwt86Src