fix some spec links (#9657)

cannon/docs/README.md

@@ -45,7 +45,7 @@ There are 3 types of witness data involved in onchain execution:
 ### Packed State
 
 The Packed State is provided in every executed onchain instruction.
-See [Cannon VM Specs](https://github.com/ethereum-optimism/specs/blob/main/specs/cannon-fault-proof-vm.md#state) for
+See [Cannon VM Specs](https://github.com/ethereum-optimism/specs/blob/main/specs/experimental/fault-proof/cannon-fault-proof-vm.md#state) for
 details on the state structure.
 
 The packed state is small! The `State` data can be packed in such a small amount of EVM words,

op-node/README.md

 # op-node
 
-This is the reference implementation of the [rollup-node spec](https://github.com/ethereum-optimism/specs/blob/main/specs/rollup-node.md).
+This is the reference implementation of the [rollup-node spec](https://github.com/ethereum-optimism/specs/blob/main/specs/protocol/rollup-node.md).
 
 ## Compiling
 

op-node/rollup/derive/channel_out.go

@@ -22,7 +22,7 @@ var ErrChannelOutAlreadyClosed = errors.New("channel-out already closed")
 // This is the fixed overhead frame size, calculated as specified
 // in the [Frame Format] specs: 16 + 2 + 4 + 1 = 23 bytes.
 //
-// [Frame Format]: https://github.com/ethereum-optimism/optimism/blob/develop/specs/derivation.md#frame-format
+// [Frame Format]: https://github.com/ethereum-optimism/specs/blob/main/specs/protocol/derivation.md#frame-format
 const FrameV0OverHeadSize = 23
 
 var CompressorFullErr = errors.New("compressor is full")