[Change] module-migration-05 quality parity + modules PR orchestrator

[djm81]

Summary

Implements module-migration-05 quality parity and CI hardening for specfact-cli-modules.

Refs:

• specfact-cli issue: [Change] module-migration-05 - Modules Repo Quality Parity specfact-cli#334
• related migration item/change: migration-02 #316, module-migration-05

Scope

• Bundle source changes under packages/
• Registry/manifest changes (packages/*/module-package.yaml)
• CI/workflow changes (.github/workflows/*)
• Documentation changes (docs/*, README.md, AGENTS.md)
• Security/signing changes (scripts/sign-modules.py, scripts/verify-modules-signature.py)

Bundle Impact

List impacted bundles and version updates:

• nold-ai/specfact-project: 0.40.15 -> 0.40.16
• nold-ai/specfact-backlog: 0.40.15 -> 0.40.16
• nold-ai/specfact-codebase: 0.40.14 -> 0.40.15
• nold-ai/specfact-spec: 0.40.13 -> 0.40.14
• nold-ai/specfact-govern: 0.40.13 -> 0.40.14

Validation Evidence

Required local gates

• hatch run format
• hatch run type-check
• hatch run lint
• hatch run yaml-lint
• hatch run check-bundle-imports
• hatch run contract-test
• hatch run smart-test (39 passed)

Signature + version integrity (required)

• hatch run verify-modules-signature --require-signature --enforce-version-bump
• Changed bundle versions were bumped before signing
• Manifests re-signed after bundle content changes

CI and Branch Protection

• PR orchestrator jobs expected:
  • verify-module-signatures
  • quality (3.11)
  • quality (3.12)
  • quality (3.13)
• Branch protection required checks are aligned with the above (to be updated after this PR run registers checks)

Docs / Pages

• Bundle/module docs updated in this repo (docs/)
• Pages workflow added/reviewed (docs-pages.yml)
• Cross-links from specfact-cli docs updated

Checklist

• Self-review completed
• No unrelated files or generated artifacts included
• Backward-compatibility/rollout notes documented (new orchestrator and required checks rollout)