fix(ship): tighten Plan Completion gate

[vaskockorovski]

Summary

A real failure mode surfaced during a recent autoplan sprint: a PLAN.md acceptance criterion (a CROSS-REPO file deliverable) shipped silently. The Plan Completion subagent existed (added in v1.4.1.0) but the gate let it through.

Four structural fixes to ship/SKILL.md Step 8:

1. Path concreteness rule — items naming a concrete filesystem path MUST be classified DONE/NOT DONE via [ -f <path> ], never UNVERIFIABLE. UNVERIFIABLE is now reserved for genuinely abstract checks (DNS, external auth allowlists) or unreachable sibling roots.
2. Validator detection — CONTENT-SHAPE items now scan the target repo's package.json for validate-* / lint-wiki / check-docs scripts and run them before falling back to UNVERIFIABLE. A passing validator promotes the item to DONE; a failing one demotes to NOT DONE.
3. Per-item UNVERIFIABLE confirmation — replaces the prior blanket "I've checked each one" gate with a per-item Y/N/D loop. The blanket-confirm path is the exact failure shape that surfaced in the sprint (user clicks A without opening any file). Cap at 5+ items presents an explicit numbered list with a warning option.
4. Subagent fail-closed — replaces "Never block /ship on subagent failure" with explicit AskUserQuestion if both the subagent and inline fallback fail. Default is stop. Silent fail-open was the second-order failure mode.

Test plan

• bun test test/ship-plan-completion-invariants.test.ts — 5 assertions, ~60ms, no LLM dependency. Locks each of the four invariants against accidental rollback.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith with what you need.}

• Let Codesmith autofix CI failures and bot reviews