docs(spec): vertical-feature-spec §9.4 — list ./ui + ./di/bind-production in exports

Doc-pass agent flagged §9.4 still listed only '.', './cms', './api' as
the allowed public surface. ./ui was added in Plan 9 and
./di/bind-production in Plan 5; both belong in the canonical list.

docs/architecture/vertical-feature-spec.md

@@ -449,7 +449,7 @@ Note: `core-trpc` is `core-composition` (not plain `core`) because it transitive
 ### 9.4 Four enforcement layers
 
 1. **`package.json` dependencies** — only allowed deps declared.
-2. **`exports` maps** — feature packages expose `.`, `./cms`, `./api` only (no deep source paths).
+2. **`exports` maps** — feature packages expose `.`, `./ui`, `./cms`, `./api`, `./di/bind-production` only (no deep source paths). `./ui` was added in Plan 9; `./di/bind-production` was added in Plan 5.
 3. **ESLint `eslint-plugin-boundaries`** (lint-time) — configured in `packages/core-eslint/` flat config:
    - Enforces the five-tag rules (same rules as Turbo boundaries)
    - File-specific exemptions via `// @boundaries-ignore` comments