Fix two pre-existing stale governing-spec-ID constants

[enricopiovesan]

Summary

• graph.rs's METADATA_GRAPH_GOVERNING_SPEC and federation.rs/federation_operator.rs's test fixtures referenced spec IDs (015-metadata-graph, 026-federation-registry-routing) that don't exist in approved-specs.json — both numeric slots were reassigned to unrelated specs (015-capability-discovery-mcp, 026-event-broker) during the v0.2.0 governance batch, so approved_spec_registry_contains() has silently returned false for both since that batch landed, independent of any later work (originally surfaced while auditing traverse-registry ahead of the traverse-framework/registry extraction — see that repo's specs/014-extraction-compatibility decision-log entry 33).
• Investigation (issue Specify metadata graph model #37/Implement metadata graph projection #62 history, and abandoned branch origin/022-mcp-wasm-server commit b81a17b) found real, complete spec content had been written for both features but never merged into approved-specs.json before their numeric slots were taken by different work.
• Rather than repoint the constants at an existing-but-unrelated approved spec (which would just be the same category of bug in new clothes), this lands the two specs under fresh IDs:
  • 077-metadata-graph: written retroactively against graph.rs's shipped behavior (no committed draft of the original 015-metadata-graph exists on any branch).
  • 078-federation-registry-routing: the original spec document, recovered intact from b81a17b, reviewed against federation.rs/federation_operator.rs and found still accurate — landed largely verbatim, with its own stale cross-references to two other still-unapproved draft specs removed.
• Full rationale and alternatives considered are in docs/decision-log.md Decision 33.

Governing Spec

• 077-metadata-graph
• 078-federation-registry-routing
• 070-runtime-event-sink-boundary

Project Item

N/A — ad hoc governance-hygiene fix (not tracked against a Project board item), authorized directly by the repo owner as a one-off cross-repo exception from traverse-framework/registry's normal registry-only scope.

Validation

• cargo build -p traverse-registry -p traverse-cli-rs
• cargo test -p traverse-registry -p traverse-cli-rs — 586 tests, 0 failures
• cargo clippy -p traverse-registry -p traverse-cli-rs --all-targets — clean
• cargo fmt -p traverse-registry -p traverse-cli-rs -- --check — clean
• BASE_SHA=<merge-base> bash scripts/ci/spec_alignment_check.sh — passed locally
• bash scripts/ci/pr_body_check.sh — passed locally
• Verified no duplicate spec id/path values and all approved-specs.json paths resolve to existing files