chore(context): reconcile .project/ reader with CNCF upstream (1.3.0 -> 1.4.0)

[mlieberman85]

Summary

Reconciles darnit's .project/ reader with the current CNCF upstream
per the runbook at specs/030-dot-project-spec-sync/quickstart.md.

Upstream (cncf/automation@e9adbac) added a single new field:

```go
type Team struct {
Name string `json:"name" yaml:"name"`
Members []string `json:"members" yaml:"members"`
Managed *bool `json:"managed,omitempty" yaml:"managed,omitempty"`
}

func (t Team) IsManaged() bool {
return t.Managed == nil || *t.Managed
}
```

Nil defaults to managed; false excludes the team from CNCF resource
automation (handle verification, mailing lists, service desk, Copilot
seats). Darnit does not consume this attribute today.

Classification

teams[*].managed is NEW-IGNORED per feature 030 Q1 (parse-only
scope). The reader's existing unknown-field catch-all in
_parse_maintainer_teams puts it in MaintainerTeam._extra["managed"]
automatically. No dataclass, parsing helper, or new attribute
needed -- when a control eventually wants to consume it, that's a
separate feature.

Changes

• .github/dot-project-spec-hash.txt:
  afa3d17... -> e9adbac....
• packages/darnit/src/darnit/context/dot_project.py:
  DOT_PROJECT_SPEC_VERSION 1.3.0 -> 1.4.0, plus the reconciliation-
  history docstring + inline note.
• tests/darnit/context/test_dot_project.py: pinned version-check
  test renamed from test_spec_version_bumped_to_1_3_0 to _1_4_0.

Test plan

• pytest tests/darnit/context/test_dot_project_upstream.py -v
  passes (was blocking every open PR).
• pytest tests/darnit/context/test_full_field_coverage.py
  passes without golden update (NEW-IGNORED doesn't change reader
  output shape).
• Full darnit sweep: pytest tests/darnit/ -q -> 1808 pass,
  8 skip, 0 fail (after the pinned-version test rename).

Not this PR

• Does not expose managed as a MaintainerTeam attribute (Q1:
  parse-only).
• Does not touch DotProjectWriter. Writer stays scalar-only.
• Does not touch packages/darnit-baseline/. Per plan §Project
  Structure this is core-only.

Closes #397.