deps(rankweave): consume canonical 0.18.0 package after owner publication

[seonghobae]

Consumer gap

Protected main@83eba56149eb802cd63642c507c324c9976ec78e currently consumes RankWeave through an exact VCS dependency:

rankweave @ git+https://github.com/ContextualWisdomLab/RankWeave.git@61c49c50d3b4a24fc9bd7c6d3a7f2f4ba19d7be6

That commit is the immutable RankWeave GitHub Release v0.18.0, but the canonical PyPI project currently exposes only 0.1.0. RankWeave issue #35 owns the failed v0.18.0 Trusted Publisher path and the required package-index publication/provenance verification.

This issue owns only the LineageWeave consumer bump after the canonical owner completes that release. Do not copy RankWeave implementation into LineageWeave, introduce a mutable branch/tag dependency, publish RankWeave on its behalf, add an alternate registry, or bypass the owner release gate.

Dependency

Blocked on ContextualWisdomLab/RankWeave#35 acceptance:

• canonical non-yanked rankweave==0.18.0 wheel and sdist are published;
• their hashes match the immutable owner release handoff;
• PyPI/GitHub attestations verify against the exact files;
• no token/username-password fallback weakens the Trusted Publisher boundary.

RED → GREEN consumer acceptance

1. RED: protected/current candidate still contains the exact Git VCS RankWeave requirement and corresponding uv.lock Git source.
2. After the owner release is immutable and verified, replace only that dependency boundary with the canonical released package version compatible with the owner contract.
3. Regenerate the universal lock normally; no hand-edited lock metadata.
4. Verify uv sync --frozen from the committed lock and installed-package identity resolves RankWeave 0.18.0 from the canonical package index rather than Git.
5. Run the existing RankWeave/lineage fusion consumer contract and exact-head full CI/security/SBOM/license/provenance gates. Preserve LineageWeave-owned channel evidence, authorization, persistence, and reconstruction semantics; RankWeave remains the fusion/evaluation owner.
6. Update architecture/dependency/release documentation and docs/product-technical-gap-baseline.md only with dated exact evidence.
7. Normal protected integration only after terminal required GREEN and qualifying independent review. No self-approval or gate weakening.

Until the owner publication exists, the current exact commit pin remains preferable to inventing a package version or using a mutable dependency.