CNCF .project/ spec drift detected: reconcile dot_project.py and update tracked hash

[mlieberman85]

Summary

The upstream CNCF .project/ specification (utilities/dot-project/types.go) has changed since we last synced. tests/darnit/context/test_dot_project_upstream.py::TestUpstreamSpecSync::test_upstream_spec_unchanged is failing on CI because of it.

Tracked hash (in .github/dot-project-spec-hash.txt):
d8ca8361c0aff434e9d7288851717f88f149785419ca062a520cdd506ae6b27e

Current upstream hash (as of 2026-08-13):
860df23ecfd970b3d603098b6597a787e7ee6954b8592cdd17e431198eff70b4

Source of truth:
https://github.com/cncf/automation/tree/main/utilities/dot-project

What needs to happen

1. Diff upstream types.go against what we saw at hash d8ca8361....
2. Update packages/darnit/src/darnit/context/dot_project.py to handle any new / renamed / removed fields.
3. If the spec version identifier moved, bump DOT_PROJECT_SPEC_VERSION in dot_project.py.
4. Regenerate the tracked hash: uv run pytest tests/darnit/context/test_dot_project_upstream.py -v --update-hash.
5. Also glance at open CNCF PRs (https://github.com/cncf/automation/pulls) so we know whether more churn is queued.

Blast radius

• Blocks the Test job on any PR whose CI runs after the drift (PRs test(parity): two-tier audit parity test suite (Fixes #366) [stacked on #365] #370 and test(parity): add OpenAI Tier 2 backend + SkillInvocationBackend Protocol (Fixes #368) [stacked on #370] #371 currently show this failure).
• Independent of any current review-in-flight work; the code the test guards is orthogonal to the parity-tests and OpenAI-backend PRs.
• Local sweep still passes on those PRs because pytest's -m integration filter behaves differently at the wide tests/ collection than at directory-scoped runs -- worth confirming separately whether that's a plugin quirk or a pyproject config side effect.

Suggested handling

Small standalone PR: reconcile any spec differences, bump DOT_PROJECT_SPEC_VERSION, refresh the tracked hash file. Should be low-risk if upstream only added fields (we can ignore them safely) and higher-scope if a field we depend on was renamed.