[process-gap] POL-003 bidirectional-pin cascade is non-terminating for governance-only Traceability-Stories-row bumps

## Problem

POL-003 (BC/VP ↔ story bidirectional version pins) is provably non-terminating when the ONLY content of a version bump is a Traceability-Stories-row citation update.

Concretely, the cycle:
1. Story bumps → cite new BC version in Token Budget/Task rows.
2. BC bumps to update Traceability Stories-row citation to new story version. **This is a governance-only bump with no substantive contract change.**
3. Strict POL-003 → story must re-bump to cite new BC version.
4. GOTO 2.

Each step is compliant with POL-003 strictly interpreted; the loop only terminates if either (a) an agent voluntarily stops citing, or (b) a `[UNVERIFIED]` marker or explicit exception is applied.

## Impact

Every S-6.05-scale story cycle spends 1–2 fix-bursts chasing governance-only cascade drift. Pass-N adversary correctly flags the drift, spec-steward correctly resolves it, but the resolution creates a fresh drift for Pass-N+1. Wall-clock cost is real: at ~1M tokens per adversary+fix-burst pair, this is a meaningful cycle tax.

## Concrete Evidence (switchboard-blue S-6.05 cycle)

- Pass-3: BC-2.07.001 bumped v1.11 → v1.12 (substantive Ruling propagation).
- Pass-4: F-P4L3-HIGH-1 discovered story still pinned v1.11 → story v1.6 → v1.7 sync-bump.
- Pass-4 fix-burst: BC bumped v1.12 → v1.13 to update Traceability Stories row from S-6.05 v1.5 → v1.7 (governance-only Stories-row-only bump).
- Pass-5: F-P5L3-MED-1 discovered story v1.7 + VP-048 v1.8 still pin BC v1.12; strict POL-003 → story v1.7 → v1.8, VP v1.8 → v1.9, BC v1.13 → v1.14 (Stories-row-only bump) → ...

Evidence in-tree: `.factory/stories/S-6.05.md`; `.factory/cycles/cycle-1/adversarial-reviews/S-6.05-adversary-pass-5.md` (F-P5L3-MED-1).

## Proposed Policy Amendment (POL-003 §Exception A)

Add a policy exception: BC or VP version bumps whose SOLE substantive content is a Traceability-Stories-row (or Story-Trace-row) citation update are classified as `[non-cascading governance leaf]` bumps. Downstream story pins DO NOT need to be re-synced for these leaf bumps.

**Enforcement rule:**
- If a BC/VP version-bump changelog entry contains only text matching `/Traceability Stories row cite [A-Z]+-[0-9.]+ v[0-9.]+ → v[0-9.]+/` (or equivalent pattern), spec-steward marks the bump as `governance_leaf: true` in the changelog frontmatter block. Downstream sync obligation is waived for these bumps.
- Adversary L3 lens observes `governance_leaf: true` flag and does NOT flag story/VP pins as stale against `governance_leaf` BC versions.
- On the next SUBSTANTIVE BC/VP bump, cascade resumes normally against the new version.

**Alternative (simpler):** drop bidirectional pinning for the Stories-row citation entirely. Cite BC as `BC-` (no version) in the Stories row and let the version live only in the BC's own version field. This eliminates the loop at the cost of some in-line auditability.

## Sibling / Cross-refs

- #396 (spec-steward citation-corpus sweep on BC-bump) — related; this proposes narrowing the sweep to non-leaf bumps.
- #428 (POL-001-verify-attestations) — sibling `[process-gap]` from the same S-6.05 cycle.

## Severity

**MEDIUM.** No production-safety impact; pure governance loop consuming ~1 fix-burst per story cycle. But: reliably reproduces, is provably non-terminating under strict POL-003, and each convergence cycle carries the cost.