ci: pin SpecSync Action to @v6 with version 6.0.0

[0xLeif]

@v6 omitted-input default is 6.0.0; @v6.0.0 / tag-object 3c2ed497 still defaults to 6.0.0-rc.14. Keep explicit version: "6.0.0".

[0xLeif]

Merge note: this is ready, and the only thing holding it is one approving review.

Verified on the head of this branch:

• The pin is CorvidLabs/spec-sync@v6 with an explicit version: "6.0.0", which is the org standard. Both halves matter: the floating @v6 tag defaults an omitted version to 6.0.0, but the immutable @v6.0.0 tag still embeds default: '6.0.0-rc.14', so the explicit input is what guarantees stable 6.0.0 regardless of which tag is in use. I read both action.yml revisions to confirm that rather than taking it on trust.
• CI is green. No check is failing.
• Branch protection here requires 1 approving review and this PR is authored by 0xLeif, so it cannot be self-approved.

No gate was weakened and nothing outside the pin was touched. Ready to merge as soon as someone approves.

[corvid-agent]

CoS APPROVE tip f623fcec — SpecSync Action pin @v6 + version: "6.0.0" in the strict gate step.

Exact-head: Trust + Analyze/CodeQL green. Squash OK.