Rotate pinned OpenSpec CLI fixture to 1.14.1 (update-openspec-cli-1141)

[Gaubee]

Summary

In-window patch rotation for the unchanged v14 window (>=1.14.0 <1.15.0): the pinned executable, every pin guard, and the reference submodule move from v1.14.0 (94ca9c1e) to v1.14.1 (87c3595). No new command/flag/capability (src/index.ts byte-identical; zero agent-delivery-surface commits), so the compat gate, Agent registry series, and generator staleness baseline do not move.

Also repairs a recorded regression: the 2026-10-02 release commit 06dec8b9 accidentally reverted the references/openspec gitlink to v1.13.0; no PR had opened since, so the PR-time guards never fired. This PR re-pins the gitlink — pr-quality.yml's prepare guard validates it on CI for the first time since.

The two 1.14.1 behavior facts become pinned fixtures

• apply all_done separates completion from archive readiness — state value/chain unchanged; instruction reports completion and asks for review before archiving; the retired ready to be archived phrasing never appears in the payload.
• overlength (>500 chars) requirements, including ADDED in a change, become strict-failing WARNINGs — non-strict stays green, --strict fails.

The new archive diagnostic code archive_retirement_cleanup_failed passes through the existing open-string diagnostic typing as verbatim evidence (forcing a cleanup failure needs FS fault injection, so it is report-documented, not fixture-pinned — see references/openspec-1.14.1-report.md P1).

Evidence

• Red first: stale 1.14.0 identity assertion failed at expectPinnedVersion before the constant rotation.
• Matrix green against the 1.14.1 executable: 16 files / 49 tests, zero assertion relaxations; the retained 1.13.2 executable still proves the boundary negatives.
• Frozen-tree broad gates: format:check (21 files), lint:ci, typecheck, test:ci (full rerun, inner exit 0), test:browser:ci (after machine-local Playwright chromium install).
• openspec validate update-openspec-cli-1141 clean (the first spec-delta draft tripped 1.14.1's own overlength WARNING and was split per the advisory's advice).
• Codex remix review: Round-A 6.8/10 REVISE — four delivery-discipline blockers (changeset, format, stale AGENTS clean-build pin, frozen full-gate evidence), all folded and re-verified → Round-B 8.8/10 APPROVE, no remaining blockers. The lockfile diff noise was investigated: a minimal 10-line semantic edit passes --frozen-lockfile but fails format:check (the current prettier canonicalizes the whole file; main's compact style was never gate-checked because the gate only sees changed files) — gate compliance wins, documented in the implementation log.
• Changeset included (openspecui/@openspecui/core/server/web patch) per changeset-check.mjs and the 1131/1132 rotation precedents.

Release only on explicit owner request; no UI change ships, so the Owner browser-walkthrough boundary is unchanged.