build(deps): bump cinc-api to v0.13.0 and cinc-supermarket-api to v0.6.0

[tas50]

Updates the two API libraries to their latest releases.

This is a module rename, not just a version bump

Both libraries moved from the tas50 org to cinc-project, mirroring the move this repo made for its own module in a8636e3. The new path is declared inside their go.mod files, so the old path no longer resolves at these versions:

go: github.com/tas50/cinc-api@v0.13.0 requires github.com/tas50/cinc-api@v0.13.0: parsing go.mod:
	module declares its path as: github.com/cinc-project/cinc-api
	        but was required as: github.com/tas50/cinc-api

Upgrading therefore means rewriting the import paths, not just bumping versions.

Module	From	To
cinc-api	tas50/... v0.12.0	cinc-project/... v0.13.0
cinc-supermarket-api	tas50/... v0.4.2	cinc-project/... v0.6.0

What changed

Neither release changes the Go API surface, so no call sites needed edits. Both packages are imported under aliases (cinc, sm), which kept the rewrite confined to import blocks.

• Import paths rewritten across 119 Go files.
• gofmt reordered those import blocks, because github.com/cinc-project sorts ahead of github.com/spf13 where github.com/tas50 sorted after it.
• Prose references updated in CLAUDE.md, AGENTS.md, and docs/dev/, matching how a8636e3 handled the same docs.
• Corrected two doc comments in cli/supermarket that named the library without its -api suffix and still pointed at the old org.

No changes to docs/commands/: make docs reports no drift, since no help strings moved.

Verification

• golangci-lint run ./...: 0 issues
• go build ./..., go vet ./..., go vet -tags acceptance ./test/...: clean
• gofmt -l .: empty
• go test ./...: all packages pass
• go test -tags acceptance ./test/...: passes against a live cinc-zero
• make docs: no drift

Because the diff is a mechanical sweep over 126 files, it was audited with git diff -U0: every added line contains cinc-project and every removed line contains tas50, so nothing unintended crept in.

Supply-chain note

The dependency org changed, so that was checked explicitly. repos/tas50/cinc-api and repos/tas50/cinc-supermarket-api both return a GitHub transfer redirect to cinc-project/... with fork: false and source: null, meaning the original repositories were transferred rather than replaced by look-alikes. The destination is the same org that owns this repo. Both tags were cut by the original maintainer, go mod verify reports all modules verified, GOSUMDB is the default sum.golang.org with no GOPRIVATE/GOFLAGS bypass, and there are no replace directives.