feat(skills): add spec-brainstorm — a question-driven on-ramp to csdd spec

[protonspy]

Summary

Adds a new shipped skill, spec-brainstorm, that adapts the superpowers brainstorming technique to csdd. It closes a real gap: today an agent jumps from a one-line idea straight to filling requirements.md from its own assumptions. The skill instead:

1. Explores context (steering + recent specs) before asking anything.
2. Runs a scope/decomposition check — an oversized idea is split into separate specs first.
3. Asks a batched multiple-choice question set (problem · target user · success criteria · constraints · error/edge cases · non-goals · integration points), with a free-text fallback and YAGNI.
4. Proposes 2-3 approaches with a recommendation; the user picks one.
5. Generates requirements.md from the recorded answers (EARS; gaps marked [ASSUMPTION]), runs csdd spec validate.
6. Hands into csdd's existing requirements gate — no auto-approve, no design/tasks/code, phase order unchanged.

It carries the project's enforcement layer — Iron Law: requirements from recorded answers, never assumptions; no artifact before an approach is chosen — plus a Rationalizations table and Red-Flags self-check.

Design choices

• Feature-level, distinct from the product-level discovery-* skills (PRD/vision).
• Batched questions via the harness question tool (matches the requested "question list → generate spec" UX), improving on superpowers' one-at-a-time, with a fallback for deep topics.
• Stops at requirements — design/tasks remain separate human gates.

What changed (committable)

• internal/templater/templates/skills/spec-brainstorm/SKILL.md.tmpl — the new shipped skill (the layer-3 copy is gitignored, kept byte-identical).
• internal/cli/cli_test.go — a regression guard in TestShippedWorkflowSkillsValidate (+ a docstring touch).

No Go product logic changed: the templater discovers shipped skills by directory walk over //go:embed all:templates, so the skill ships by adding the template alone — proven by the guard (a fresh csdd init scaffolds it and it validates).

Spec

spec-brainstorm-skill (gitignored layer-3, dogfooded locally) — requirements → design → tasks human-approved; tasks 1–6 complete; development_flow: unit.

Verification

```

• make check ✅ (gofmt clean + vet + race tests, all packages; passed at pre-push)
• csdd skill validate spec-brainstorm ✅
• byte-parity layer-2 ↔ layer-3 ✅ empty diff
• TestShippedWorkflowSkillsValidate (guard) ✅ fresh init scaffolds + validates spec-brainstorm
• behavioral dry-run (subagent) ✅ produced the batched question set; refused to write requirements before an approach was chosen
• code-reviewer (adversarial) ✅ APPROVE, 0 Blockers / 0 Important
  ```

Risks

• Pure additive shipped skill (+ a test-only guard); no Go production logic touched. Downstream users receive spec-brainstorm on the next csdd init/update.

Note

Independent of #33 (discipline-skill hardening). The guard was added as a separate block to avoid a merge conflict with #33's change to the same test.

🤖 Generated with Claude Code