docs(skills): refactor-protocol — rename sweeps need word-boundary grep and an end-to-end test

[JArmandoAnaya]

Encodes a lesson from the visionset ui → visionset server rename into the skill that governs
implementation tasks. Docs-only: three bullets at the tail of ## Scope discipline, no other file
touched.

The rule

• A phrase grep for the old spelling is not proof of scope when a task renames or removes a
  command, subcommand, flag, or public symbol.
• The corrective sweep is a word-boundary grep for the bare name over code and config —
  git grep -nwE "<name>" — alongside the phrase grep, which still covers prose and docs. Every
  hit is triaged: updated, or named in the PR body as deliberately left.
• The proof is a test that exercises the renamed surface end to end — for a CLI command, one
  that spawns the real process.

Why a phrase grep is structurally blind

The call sites that actually run a command spell its name as a separate argv element
(["visionset", "ui", "--host", …]), so the contiguous text visionset ui never appears in the
file that invokes it. The same applies to a name travelling as a config value, a dict key, or a
string-built identifier — which is why the sweep has to match the bare word, and why a test that
patches the implementation underneath the name can never notice the name is wrong.

cf. #333 — where git grep -n "visionset ui" reported zero remaining hits while
examples/http_end_to_end.py was still invoking the removed command. A subprocess-based test
caught it; the unit test that patches uvicorn.run could not have.

Placement

The bullets go at the end of ## Scope discipline, which already owns what counts as in scope —
this is the "how you prove you covered it" beat. Same bold-lead voice and — #NNN provenance tag
as the surrounding rules. The rest of the skill is untouched.

.agents/skills/ is the canonical copy; the .claude/skills/ symlinks are generated and
git-ignored.

Test plan

Everything scripts/check.sh runs, all three suites, green. A docs-only change should move no
test outcome and no generated artifact, and none moved — the diff is one file, three insertions,
and all four drift gates (openapi drift, generated client drift, mcp tool reference drift,
version sync) pass.

The run was executed in stages rather than as one bash scripts/check.sh invocation, because this
machine kills any single command at ten minutes and the full run takes longer than that. Stages
and their exit codes:

stage	result
pytest tests/kernel	exit 0
pytest tests/server	exit 0
pytest tests/{architecture,cli,formats,mcp,scripts} test_versioning.py	607 passed, 2 skipped
pytest tests/examples	41 passed
pytest tests/packaging	1 skipped — opt-in, the wheel CI job owns it
ruff check / ruff format --check	clean, 279 files
mypy src/visionset	no issues, 118 files
lint-imports	Contracts: 2 kept, 0 broken
check.sh frontend generated	exit 0, 254s
check.sh browser	exit 0 — annotator + app e2e, and the real-server cycle

cf. #336 — in a fresh worktree check.sh stops at missing node_modules rather than failing
loudly, so the run was preceded by pnpm install --frozen-lockfile.