[CTX-0067] docs(spec): amend manifest authority to accept [components] and [[network.egress]] (DIR-030)

[Xuepoo]

Priority: P1 | Area: area:package | Labels: docs,P1,area:package | Milestone: v0.1.0 | RFC: DIR-030 | Task: CTX-0067

Closes #126

Commander decision (dated accepted amendment, 2026-10-02): specifications/manifest-capability-authority.md section 6 classified [[network.egress]] as rejected and the Plugin Platform RFC manifest schema lacked [components], but the accepted DIR-030 Native Component Boundary and the bitty host parser (NetworkEgress in bitty-plugin-host/src/manifest.rs, grant computation in bitty-runtime/src/component/grant.rs) depend on both.

Changes

• specifications/manifest-capability-authority.md: section 6 now accepts [components] (component name [a-z][a-z0-9-]{0,31} -> caret semver requirement, candidate bound 8 pending host enforcement) and [[network.egress]] ({host, ports}, exact host no wildcard, bounded ports MAX 16/16, fail-closed pairing with network.connect:HOST[:PORT], grant = capability intersect egress). Added dated amendment subsection with rationale, updated authority table, valid/invalid example corpus, and SDK/host/template/docs requirement lists.
• specifications/plugin-platform-rfc.md: accepted manifest schema fragment now shows [components] and [[network.egress]]; added validation rule 10 cross-linking the amendment.
• extensibility/package-management.md: cross-links the amendment from the Component packages section and shows the paired [[network.egress]] example.
• sdk/net-request-surface-candidate.md: the Open points item naming this conflict is resolved and removed; Affected contracts updated to point at the amendment. Status stays draft.

Verification (read-only against bitty repo, never wrote there)

• DIR-030: bitty-docs docs/development/native-component-boundary.md (accepted, [components] net = ^0.0.1 caret Cargo semantics, name [a-z][a-z0-9-]{0,31}).
• Host parser: bitty/crates/bitty-plugin-host/src/manifest.rs NetworkEgress validate_egress_host (exact lowercase DNS, no wildcard, 253/63 bounds), MAX_NETWORK_EGRESS 16, MAX_NETWORK_PORTS_PER_HOST 16, both-directions pairing with network.connect.
• Grant: bitty/crates/bitty-runtime/src/component/grant.rs PluginGrant::compute (capability intersect egress, bare HOST admits all declared ports, HOST:PORT admits only declared port).
• Component name: bitty/crates/bitty-runtime/src/component/descriptor.rs validate_component_name [a-z][a-z0-9-]{0,31}, COMPONENT_NAME_MAX_BYTES 32.
• just check: exit 0, 0 issues across 103 files.
• act -n: exit 0, all jobs dry-run green.