docs(specs): correct the renovate design after adversarial review

[maybebyte]

Summary

Gap #6 of the dogfooding-gap audit (adopt Renovate on the maintainer repo) was about to be implemented from a design whose two central config decisions were wrong. This amends the design spec before any renovate.json is written.

Changes

• Corrected the packageRules entry from matchDepNames: ["uv"] to matchPackageNames: ["astral-sh/uv"]. matchDepNames matches depName only. Renovate's mise manager surfaces mise.toml's pin as depName uv, but its github-actions manager extracts astral-sh/setup-uv's version: input as astral-sh/uv. The original rule would have silenced the mise.toml site while leaving all five workflow inputs free to bump — causing the desync it was written to prevent. The shared packageName covers both, and does not touch the action's own digest pin.
• Corrected the claim that a uv manager exists. pep621 is the manager reading pyproject.toml/uv.lock, and it must stay enabled. A top-level "uv" key is an invalid configuration option that aborts the repository run, so the config would have looked like it closed the gap while producing zero PRs.
• Refreshed premises invalidated by gaps docs(specs): add dependency-inventory design spec #1–docs(plans): add dogfooding-gap audit of shipped guardrails #5 and feat(audit): dogfood the pip-audit dependency-audit gate on the maintainer repo #8, and recorded three findings no prior document had: lockFileMaintenance is load-bearing (all dev deps are capped ranges, so pep621's replace strategy opens no PRs for in-range releases — including the spec's own motivating examples); no manager can see the template/ layer because every file there is .jinja, promoting a pin-parity test from follow-up to precondition; and the template ships "pre-commit": {enabled: true} alongside bare-SHA revs, which now needs an explicit decision. Sequence reordered to tag → parity test → enable app → branch protection → config.

Testing

• Docs-only change; no automated tests apply. just policy — 5 passed (the docs-can't-lie and SHA-pin gates read AGENTS.md, untouched here).
• uv run pre-commit run --all-files — merge-conflict, end-of-file, and trailing-whitespace hooks passed; ruff hooks skipped (no Python files).
• Corrections cross-checked against the repo: the five uvx pins (justfile:60,70; test-template.yml:54,106,108), the six uv sites (mise.toml:3; test-template.yml:31,49,65,81,101), the capped dev-dep ranges (pyproject.toml:17-25), and the stale test_generation.py citations (:788/:797/:802 → :825/:834/:836-839).

Notes for reviewers

• Inert on merge — this changes a design document only. No renovate.json is added and no Renovate behaviour changes.
• Two claims are deliberately marked as unconfirmed in the spec rather than asserted: the pre-commit manager's bare-SHA handling is a static source trace, not an executed run (a second, independent reason to keep that manager off is recorded, which holds regardless); and "the Mend app has never been enabled" is an argument from absence, since direct installation queries are blocked by token scope.
• Two operator preconditions are now on the critical path and cannot be done from the implementation side: enabling the Mend Renovate app, and adding branch protection to main (confirmed absent — /branches/main/protection returns 404, /rulesets returns []). Without the latter, the parity guards this design relies on are advisory, since nothing blocks a merge past a failing check.

Related

• Amends docs/superpowers/specs/2026-06-25-dependency-inventory-design.md; implements no part of it.
• Gap chore(pre-commit): dogfood the shipped pre-commit gate on the maintainer repo #6 in docs/superpowers/plans/2026-07-01-dogfood-gap-audit.md, whose wiring bullets carry the same two defects and should be corrected when that gap is implemented.