docs(agents): teach the denylist escalation path in role cards + delivery brief

[dngioidev]

What

Delivery agents (orchestrator + spawned subagents) repeatedly reached for denylist-blocked destructive commands, hit the block, and burned a turn retrying. This teaches the safe alternative + escalate-don't-retry path up front, in the three artifacts a delivery agent actually reads.

One canonical block (identical wording, so the copies can't drift) added to:

• plugin/cards/implementer.md — the implementer role card (recompiled to plugin/agents/implementer.md)
• plugin/skills/deliver/SKILL.md — the deliver skill
• plugin/skills/autopilot/SKILL.md — the § Orchestration spawn brief the loop hands each delivery subagent

The block maps each denylisted destructive class (verified against plugin/hooks/denylist.mjs) to its safe alternative, states the escalate-don't-retry rule, and carries the literal-string / --body-file caveat.

Acceptance criteria

• AC.1 — the implementer and deliver role cards teach the safe alternative for each denylisted destructive class up front: recursive removal outside build/temp -> targeted removal by path; hard-reset -> git revert / git restore <paths>; force-push -> --force-with-lease (only when explicitly requested); clean-force -> targeted removal.
• AC.2 — the autopilot delivery brief carries the same safe-alternatives list plus the rule: on a denylist block, escalate — do not retry the blocked command.
• AC.3 — the guidance includes the literal-string caveat: the denylist matches blocked-command strings inside quoted/heredoc bodies, so content that must mention a blocked command is written via a file + --body-file, never inline on a shell command line.
• AC.4 — tests/skills/denylist-guidance.test.mjs asserts the safe-alternative / escalate-don't-retry / caveat guidance is present in the role cards, the deliver skill, the autopilot brief, and the compiled implementer agent, so it cannot silently regress (mirrors the existing skill-text assertions).

Verification

• pnpm verify — 675 passing / 58 files, all green (includes the new denylist-guidance suite, the card freshness gate, and the deliver/autopilot skill-text suites).
• node plugin/scripts/backends/compile.mjs re-run so the compiled implementer agent matches its card (freshness gate green).
• Dogfooded the fix being shipped: every trail comment, the commit body, and this PR body that mention the blocked command strings were staged to a file and passed via --body-file / -F, never inline on a shell command line.

Closes #346

🤖 Generated with Claude Code