Validate shipped AI prompt CLI command contracts

[djm81]

Why

Primary tester reports showed that shipped AI slash prompts can drift from the live SpecFact CLI command surface. Because these prompts are bundle payloads, stale command paths or options can ship to users even when code, docs, and signatures pass.

What Changes

• Add a prompt command validation gate for bundle-owned prompt resources under packages/*/resources/prompts.
• Validate prompt command examples and option references against the mounted Typer/Click command tree discovered from the current repo.
• Update shipped prompt guidance so prompts treat their text as operating guidance and verify CLI reality at execution time instead of acting as the source of truth.
• Wire the validator into Hatch, local pre-commit checks, Markdown-triggered CI, and OpenSpec config guidance.
• Keep .github/prompts out of scope; OpenSpec helper prompts remain a separate governance surface.

Capabilities

New capability:

• prompt-command-validation

Modified capabilities:

• bundle-packaged-resources
• resource-aware-integrity

Parent Tracking

• Parent Feature: [Feature] Validation And Governance Runtime Follow-Ups #163
• Parent Epic: [Epic] specfact code #162
• OpenSpec change: prompt-command-contract-validation
• PR: [codex] Validate shipped prompt CLI commands #265

Validation Evidence

• openspec validate prompt-command-contract-validation --strict
• hatch run validate-prompt-commands
• hatch run test: 663 passed, 2 warnings
• hatch run smart-test: 663 passed, 2 warnings
• hatch run contract-test: 663 passed, 2 warnings
• SpecFact code review changed-scope gate: zero findings

Notes

Local module signing used checksum-only manifests because no private signing key is configured in the local environment. The normal CI/signing workflow should produce real signatures where required.