feat: add root-tags orphan detection for requirement traceability

[Malcolmnixon]

Summary

Enables ReqStream's root-tags orphan detection to catch requirements
(and their linked design/verification/code/test artifacts) that are
disconnected from product-level functionality.

Changes

• Bumped demaconsulting.reqstream 1.10.0 -> 1.11.0 (first release
  with root-tags/orphan detection).
• Tagged the 14 top-level requirements in spdx-tool.yaml and 7 in
  spdx-tool-targets.yaml with a new system tag.
• Set
  oot-tags: [system, quality] in
  equirements.yaml.
• Added children: links for cross-cutting infrastructure (Program,
  Context, Commands, Command, SelfTest, Spdx, Utility) based on the
  architecture in docs/design/spdx-tool.md.
• Fixed a systemic orphan pattern present in all 16 per-command
  requirement files: only the first requirement in each file was
  reachable from the root tree; every sibling requirement (validation
  / error-handling / workflow-detail) was disconnected. Each file's
  first requirement now lists its siblings as children:.
• Added docs/reqstream/quality.yaml, grouping all 10 OTS dependency
  requirement files into 4 quality-tagged requirements, and wired
  it into
  equirements.yaml.

Verification

• Orphan scan: 182 of 253 requirements orphaned before this change,
  0 of 253 after.
• �uild.ps1: 14/14 tests passed (pre-existing "Zero tests ran"
  harness message confirmed present on main too, unrelated to this
  change).
• ix.ps1 / lint.ps1: clean.
• dotnet reviewmark --lint: clean.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[Copilot]

🟢 Approval recommended

The updated ReqStream configuration and requirement graph links appear internally consistent (referenced IDs resolve) and align with the stated goal of eliminating orphans via root-tags.

Pull request overview

This PR updates the repository’s ReqStream requirements configuration to enable and satisfy the new root-tag-based orphan detection, ensuring all requirements (and linked artifacts) are reachable from product/quality roots.

Changes:

• Updated the local dotnet tool manifest to use demaconsulting.reqstream 1.11.0 to pick up root-tags orphan detection.
• Added root-tags: [system, quality], tagged top-level requirements accordingly, and wired additional children: links to eliminate disconnected requirement subtrees.
• Introduced a new docs/reqstream/quality.yaml rollup to connect OTS/tooling requirements to the quality root.

File summaries

File	Description
requirements.yaml	Declares root tags and includes the new quality requirements file in the ReqStream include tree.
.config/dotnet-tools.json	Bumps demaconsulting.reqstream to 1.11.0.
docs/reqstream/quality.yaml	Adds quality-tagged rollup requirements to connect OTS dependency requirements to a root.
docs/reqstream/spdx-tool/spdx-tool.yaml	Tags top-level system requirements and adds children: links to connect CLI/system requirements into the root tree.
docs/reqstream/spdx-tool/program.yaml	Adds children: links from Program-level requirements into Context/Commands requirements for reachability.
docs/reqstream/spdx-tool/self-test/self-test.yaml	Adds children: links for self-test reporting/result-extension requirements.
docs/reqstream/spdx-tool/self-test/validate.yaml	Extends orchestrator children: to include newly modeled report/serialization/format behaviors.
docs/reqstream/spdx-tool/utility/utility.yaml	Links the utility rollup to the wildcard-timeout requirement to keep it reachable.
docs/reqstream/spdx-tool/commands/commands.yaml	Adds children: links under command registry/dispatch requirements to connect shared command infrastructure.
docs/reqstream/spdx-tool/commands/add-package.yaml	Adds children: links so the top-level add-package requirement reaches its detailed validation/workflow requirements.
docs/reqstream/spdx-tool/commands/add-relationship.yaml	Adds children: links so the top-level add-relationship requirement reaches its validation requirements.
docs/reqstream/spdx-tool/commands/copy-package.yaml	Adds children: links so the top-level copy-package requirement reaches its detailed requirements.
docs/reqstream/spdx-tool/commands/diagram.yaml	Adds children: links so the top-level diagram requirement reaches its detailed requirements.
docs/reqstream/spdx-tool/commands/find-package.yaml	Adds children: links so the top-level find-package requirement reaches its detailed requirements.
docs/reqstream/spdx-tool/commands/get-version.yaml	Adds children: links so the top-level get-version requirement reaches its detailed requirements.
docs/reqstream/spdx-tool/commands/hash.yaml	Adds children: links so the hash generate/verify requirements reach their detailed requirements.
docs/reqstream/spdx-tool/commands/help.yaml	Adds children: links so the help requirement reaches its YAML-invocation requirement.
docs/reqstream/spdx-tool/commands/print.yaml	Adds children: links so the print requirement reaches its detailed workflow/validation requirements.
docs/reqstream/spdx-tool/commands/query.yaml	Adds children: links so the query requirement reaches its detailed validation/output requirements.
docs/reqstream/spdx-tool/commands/rename-id.yaml	Adds children: links so the rename-id requirement reaches its detailed validation/workflow requirements.
docs/reqstream/spdx-tool/commands/run-workflow.yaml	Adds children: links so the run-workflow requirement reaches its detailed validation/workflow requirements.
docs/reqstream/spdx-tool/commands/set-variable.yaml	Adds children: links so the set-variable requirement reaches its detailed validation/expansion requirements.
docs/reqstream/spdx-tool/commands/to-markdown.yaml	Adds children: links so the to-markdown requirement reaches its detailed validation/workflow requirements.
docs/reqstream/spdx-tool/commands/update-package.yaml	Adds children: links so the update-package requirement reaches its detailed validation/update requirements.
docs/reqstream/spdx-tool/commands/validate.yaml	Adds children: links so the validate requirement reaches its missing-input/NTIA-minimum requirements.
docs/reqstream/spdx-tool-targets/spdx-tool-targets.yaml	Tags top-level SpdxToolTargets requirements with system for root-tag reachability.

Review details

• Files reviewed: 26/26 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.