feat: plain-ticket spec deltas archived in the same PR (RV-100, 3.22.0)

[devondragon]

Ticket: https://linear.app/blackmagicconsulting/issue/RV-100

ccmagic 3.22.0. On a repository whose base branch has openspec/specs/<cap>/spec.md, a plain ticket (no Reeve spec: section) that changes specified behavior now carries its own OpenSpec delta, archived in the same PR as the code. The design is the RV-100 amendment in Reeve's build contract and gate design (devondragon/reeve#160, approved 2026-10-14).

Changes

• bin/ccm-spec-delta (new), with modes applies, name, collision, check, scope, and reopen. scope applies the gate's plain-delta file rules (delta-active through delta-collision) and then delta-not-applied, which replays openspec archive on the merge base's OpenSpec tree in a mktemp -d directory under $TMPDIR. It writes nothing to .git and creates no worktree.
• work-ticket: decide whether specified behavior changed, then name, write, collision-check, check, archive, validate, and scope-check the delta, correcting it at most twice before parking. Adds the PR body's ## OpenSpec section, the fix-pass rules (reopen), and the spec_delta: handshake line.
• review-ticket: findings for a missing delta, a delta that doesn't match the code, main specs that don't match the delta, and other scope rule failures (all fixable), and for a collision (needs-human).
• finish-ticket: ccm-spec-delta scope before a merge or hand-off.
• auto-ticket, the contract, and auto-work: keep spec_delta and write it to the run record (stays version: 2).
• The handshake hook accepts spec_delta:.
• ccm-propose-check's shared checks moved to ccm-lib.sh, with byte-identical output.
• docs/cyrus-deployment.md grants Bash(ccm-spec-delta *). Also updated: README, help, CHANGELOG, and the version bump.

Every new skill line sits in a <!-- ccmagic:plain-delta --> block. The baseline regression test strips these blocks the same way as the spec-only blocks, so a repository without specs runs exactly as before. The only every-ticket change recorded is one sentence in help.

Differences from the design

• I added an applies BASE mode so the skills can test "the base has specs" with their existing grants.
• name takes BASE.
• work-ticket writes the folder before the collision check (a stop restores openspec/ either way).
• A new-capability follow-up doesn't name the spec-baseline skill, because a test forbids ticket-path files from naming standalone skills.

Testing

• bash tests/run.sh: 423 passed, 0 failed, run locally with OpenSpec CLI 1.14.1. That includes 10 specdelta_* tests: every scope rule, the replay passing after the base gains an unrelated edit to the same spec, a hand edit failing, reopen and the fix-pass correction path, .git and $TMPDIR left unchanged, and an unwritable TMPDIR.
• shellcheck is clean.
• An Opus review found four issues, all fixed with tests: the fix-pass correction loop, name with a dash-leading title or an underscore key, the fix-pass route for scope rule failures, and spec_delta after a stop.

Rollout

Merge, release, and pull into the Cyrus volume before Reeve's reeve-refine-6 template and gate PRs deploy. This release is safe on its own: today's gate merges a plain PR with an archived delta at its path tier, and an older Reeve drops spec_delta when it parses the record.