foreman v0.2.8.1 — field-failure fixes

Fixes the four failures surfaced by the first real external run (a Midnight target), logged in bugeventlog.md and deep-debugged before fixing. Planned and executed via the superpowers brainstorm → plan → subagent-execute flow.

Fixes

• install.ps1 (Windows) is no longer parse-fragile. The skill link was created with cmd /c mklink /J, which a real operator hit a PowerShell ParserError on — aborting the Windows install entirely. Now a native New-Item -ItemType Junction, with a windows-latest CI smoke test (.github/workflows/windows-smoke.yml) so the whole class is caught going forward.

• grok --prompt-file empty-burst. grok --prompt-file is a single agentic burst — on an exploration-heavy spec it can spend the burst orienting and write nothing. Added: write-first doctrine (a grok spec's first instruction must be a Write with API facts inlined), an explicit empty-burst vs cancelled-writes distinction, and grok-multiround.sh — a bounded re-prompt loop that feeds forward "prior round wrote nothing; Write now" until files change or the round budget is spent (then a loud EMPTY-BURST FAILED).

• codex headless auth. codex login --device-auth (codex-cli 0.144.x) falls back to a localhost browser flow that dies on detach — it can't authenticate headless. Documented the real headless path (printenv OPENAI_API_KEY | codex login --with-api-key) and that interactive login is operator-run (! codex login), never orchestrator-launched.

• Worktree fan-out unfit for a stateful/live target. A target whose runtime lives outside the git checkout (vendored node_modules, a running proof-server, live testnet) breaks worktree isolation. Added a soft_mode.target = live config key + a wt-new guard that refuses to cut a worktree for live targets, plus the stateful/live-target profile doctrine (no worktree; grok in the working checkout; architect verifies against live services).

Quality

Each fix was TDD-implemented by a Sonnet lane and Opus-audited. The final review caught a real config-resolution bug in the live-target guard — it resolved config from the foreman skill's own repo root instead of the target repo's, so it would have silently no-opped for the exact external-target case it was built for. Fixed and regression-guarded (a test now exercises the default config path that hid it).

Full suite green (one T4b VTICK wall-clock flake cleared in isolation). Residuals (documented future options, not built): grok true multi-turn via grok agent stdio; the optional .foreman/live-target.toml preflight-WARN.