chore: delete executed plans, stop ignoring files that ship

[ttncode]

What this changes

A pass over every tracked file — not only the shell, which the last branch
covered. Two of the three findings are deletions.

docs/superpowers/plans/ is gone. Five files, 8,703 lines. They are work
orders addressed to agents — each opens with
> **For agentic workers:** REQUIRED SUB-SKILL: … — and between them carry 305
checkboxes that are all still - [ ], in a repository where every one of those
tasks shipped months ago. One still says "Work on feat/interactive-wizard,
already cut from main at b23d6dc". What was decided lives in
docs/decisions/ (24 ADRs), what it means lives in docs/tour/, and what was
built lives in the code. docs/superpowers/specs/ stays: those are design
documents with no checkboxes, and docs/tour/09-wizard.md sends a reader to
one. The two inbound references to the plans now point at ADR-0021 and at
specs/ instead.

.gitignore ignored four files that ship. package.json and
pnpm-lock.yaml were unanchored, so they matched common/package.json,
common/docs/package.json, common/docs/pnpm-lock.yaml and
common/packages-types/package.json — templates copied into every generated
project. Nothing was broken today, because git keeps tracking a file it already
tracks; the hazard is the next one. A new template added beside those four would
be dropped by git add -A without a word, and the projects generated after it
would be missing a file. Anchored to /package.json and /pnpm-lock.yaml;
node_modules/ and tmp/ stay unanchored, since a stray can appear anywhere.
git ls-files -i -c --exclude-standard is now empty.

Comments, in the trees the last branch did not reach.

	before	after
common/.github/workflows/* (5 files)	43	28
.github/workflows/adapters.yml	32	21
.github/workflows/pull-request.yml	18	14
adapters/laravel-inertia/mise.toml	31	19
services/*	19	7

The worst of it was in common/.github/workflows/, which ships into every
client repository: two comment blocks were copy-pasted verbatim into all five
call sites — thirty duplicated lines in every generated project. Each is now two
lines, still present in every file, because a client opening security.yml
alone should not have to find the explanation in build.yml.

services/ turned up a copy that had drifted: the three-line "loopback, not
0.0.0.0" comment was in mongodb, postgres and redis but not mysql, which
publishes on loopback exactly the same way. All four now carry one identical
line. And services/mysql/service.env carried a five-line note about the
digest-per-service rule — a contract every service obeys, which is why the other
three had nothing. It moved to lib/contract.sh, next to
REQUIRED_SERVICE_VARS.

How it was verified

• mise run lint — clean.
• mise run test-runner — both lanes under the runner's own environment.
• mise exec -- bats tests/provenance.bats.
• mise exec -- zizmor --min-severity medium .github/workflows/ — no findings.
• Every YAML and TOML touched was re-parsed with yq.
• git ls-files -i -c --exclude-standard before and after, for the ignore rule.
• grep -rn "superpowers/plans" over the tree, for dangling references.
• tests/cli.bats gained a check that git ls-files -i -c --exclude-standard is
  empty; run against the old rule it fails and names all four files.

What the audit checked and found nothing to do about: no function is defined
and never called; no test fixture is unreferenced; no tracked file is empty; no
paragraph is repeated across README, CONTRIBUTING, the tour and the runbooks.
The files that md5sum reports as identical are symlinks (120000) in
tests/fixtures/, or per-adapter copies that the adapter contract requires each
adapter to own.

Checklist

• mise run lint passes
• mise run test-runner passes
• New behaviour has a test that fails without the change
• Docs that describe changed behaviour were updated in the same commit
• No unrelated changes