feat(pstack): add verified multi-PR checklist

[ericlitman]

Closes #17

Why

Cursor pstack 0.14.3 replaces the old multi-file planning reference with one executable multi-PR checklist and a validator. Open Pstack needs that workflow without importing Cursor-only control, provider, or storage assumptions into the shared Claude Code and Codex skill tree.

What changed

• Replace the old planning overview with the adapted inline checklist and delete references/plan.md without a compatibility pointer.
• Resolve planning exploration through the configured judgment and prose role and live verification through the configured swarm workers role, preserving parent-owned routing, selected effort, loud dropouts, no fallback, and no implicit timeout.
• Add a dependency-free Node checker whose one CONTRACT and tagged PR block schema enforce the ordered H1/H2/H3 skeleton, PR blocks, live screenshot lanes, performance evidence, review gates, appendices, punctuation, and CLI exit contract.
• Test the real fenced skeleton, negative grammar mutations, symlinked installs, and exit 0/1/2 behavior under Bun plus strict checkJs typechecking.
• Record Cursor pstack 0.14.3 at bdf7aa355337897f167153e05069aca505dae17c in current provenance and maintenance prose while Open Pstack remains at 1.1.0 for the issue PR.

Tradeoffs

The checker validates the copied plan artifact, not the playbook file. It exports only the contract, checker, and skeleton extractor for tests. It does not generate plans, add --skeleton, preserve the deleted reference, resolve providers itself, or introduce another runtime layer.

Blast radius

The behavior change is limited to the multi-phase planning playbook and its new checker. Existing bootstrap, watcher, orchestrator, runner, standalone Babysit, and provider-dispatch behavior remains in place. The rebase retained both the bootstrap and checker test filters added by issues #18 and #17.

Verification

• Focused checker tests pass.
• Full Bun tests, strict typecheck, static invariants, manifests, Node syntax, and Claude plugin validation pass.
• Four-model Interrogate and two no-comments passes are adjudicated.
• The exact candidate is installed in every affected harness.
• Multi-PR plan-only behavior and checker acceptance pass from Claude Code and Codex.
• The small-work skip and no-invented-timeout/dropout behavior pass from both harnesses.

Local evidence:

• bun test check-plan: 54 passed, 0 failed, 184 assertions.
• bun run test: 155 passed, 0 failed, 635 assertions across 11 files.
• bun run typecheck: passed, including check-plan.mjs and check-plan.test.ts under strict checkJs.
• node --check check-plan.mjs: passed.
• Four manifest parses, PSTACK_STATIC_ONLY=1 bash tests/skill-collision-repro.sh, claude plugin validate plugins/pstack, claude plugin validate .claude-plugin/marketplace.json, and git diff --check: passed.
• The review fixed a symlinked-CLI false pass, permissive structural headings, hidden boxes in Depends on, fake live artifacts, empty performance evidence, malformed review gates, and stale provenance. The root audit added explicit rejection of extra H1/H3 structure.

Live evidence:

• Candidate head: ebfb7c636016075d91d7953ebc84ddc7bae75e64. Both installed package trees match plugins/pstack byte-for-byte excluding node_modules.
• Claude Code invoked installed pstack:poteto-mode, kept planning exploration on the native claude:claude-fable-5@max first-run route, changed only docs/claude-plan.md, and introduced no fallback or timeout. The session's command policy denied interpreter execution and the agent reported that block instead of fabricating output. The root then ran the exact Claude installed-cache checker on its artifact: three PR sections, zero problems.
• Codex invoked installed pstack:poteto-mode, resolved claude:claude-fable-5@xhigh from its configured sheet through the external runner, preserved its receipt-bearing authentication failure as a named dropout, and did not retry or substitute. It changed only docs/codex-plan.md and ran the exact Codex installed-cache checker: three PR sections, zero problems.
• Both plans contain 30 live screenshot lanes, performance evidence, review gates, dependencies, and harness-specific driver instructions. Neither plan contains a provider/model descriptor.
• Fresh small-work sessions in both harnesses returned SKIP for an obvious one-file README edit, created no plan, dispatched no explorer, performed no implementation, and left clean working trees.