feat(ci): dep PRs carry target-repo task ID and generated spec

Target repos require <PREFIX>-N in the branch name and
docs/specs/<TASK>.md in the diff. Create the Vikunja task in the
target project (--task-project-id), embed its identifier in the
branch name, and commit a generated spec with the pin bump.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

docs/specs/DEVX-171.md

@@ -0,0 +1,36 @@
+# DEVX-171: create_dependency_pr uses target-project task ID + generated spec
+
+## Problem
+
+Dep PRs fail target-repo validation: infra requires `OBL-INFRA-N` in the
+branch name and `docs/specs/<TASK>.md` in the diff. The tool created the
+Vikunja task in the *producer's* project and named the branch
+`deps/<pkg>-<ver>` with no task ID, and wrote no spec.
+
+## Approach
+
+REQ-1: Create the tracking task before branch creation, in the target
+repo's Vikunja project via `--task-project-id` (default:
+DEVX_VIKUNJA_PROJECT_ID). Embed the returned identifier in the branch
+name (`deps/<TASK>-<pkg>-<ver>`) and PR title, and commit a generated
+`docs/specs/<TASK>.md` with the required sections alongside the pin bump.
+
+## Test Plan
+
+- Branch name and PR title carry the target task ID; spec file added.
+- `create_vikunja_task(project_id=N)` passes N to VikunjaClient.
+- Existing no-task behavior preserved when Vikunja is unreachable.
+
+## Deploy Plan
+
+devx release tag; producer workflows pass `--task-project-id` for infra
+(project 3).
+
+## Rollback Plan
+
+Revert; dep PRs keep failing target validation (status quo).
+
+## Acceptance Criteria
+
+- [x] REQ-1: `--task-project-id` supported; branch/spec/PR title embed
+  the target task ID; covered by unit tests at 100% coverage.