feat(ship): add /ship single-defect audit-to-PR command

[naimkatiman]

Summary

Adds /ship, a single-defect fast-path command that walks one bug from a ground-truth audit through a TDD fix, full verification, a single-concern commit, and an open PR — then stops. It never auto-merges and never deploys.

Closes R6 from the 2026-06-17 report-coverage map: the audit→fix→PR pipeline was already composable from existing skills but had no single entry point for the common case "fix one defect, open one PR" (/release-train is multi-PR; /proceed-with-the-recommendation walks an arbitrary recommendation list).

What it does

Pure routing over existing skills, in order:

1. reconcile — git ground truth; halt on a protected branch or a stale base
2. tdd-workflow — RED failing test reproducing the defect → GREEN minimal fix
3. verification-loop — run the project verify ladder (build, types, tests)
4. one single-concern commit, Windows-safe message (single-line -m or -F <tempfile>)
5. commit-commands:commit-push-pr — push + open PR, then STOP
6. deploy-receipt — advisory post-merge SHA check (no deploy)

Scope

• In: commands/ship.md (command-only) + its generated plugin mirror + the plan doc.
• Out (deferred, not dropped): multi-PR orchestration, any new skill/hook/.mts code, deploy automation, auto-merge, and PowerShell-native fallbacks for deploy-receipt's Bash scripts (separate follow-up PR).

Files

• commands/ship.md — hand-authored source
• plugins/continuous-improvement/commands/ship.md — generated mirror (npm run build)
• docs/plans/2026-06-17-ship-command.md — plan

Verification

• npm run verify:all — green (13/13: routing-targets 37/37, tool-count expert=19 / beginner=4, everything-mirror, doc-runtime-claims, scripts-citation-drift, typecheck, …).
• install.test — 29/29 pass. ALL_COMMAND_FILES is unchanged: /ship distributes via the plugin bundle (directory-copy), not the curated standalone-installer set, so the "6 command files in beginner mode" gate stays green.
• observe.test in isolation — 12/12 pass.
• The full-suite run surfaced only subprocess-spawn timing failures (observe.sh / observe.mjs / route-prompt / hook at 5000ms+ ETIMEDOUT) while the host was saturated; all pass when run in isolation. This is the documented environmental flake class (see CLAUDE.md), not a regression — a markdown-only command cannot affect process-spawn timing.

Test plan

• CI green on the PR
• Manual: /ship <defect> on a clean feature branch routes through the stages and stops at PR-open without merging

No new dependencies. No .mts source changes (no .mjs regeneration beyond the command mirror).

[gemini-code-assist]

Code Review

This pull request introduces the /ship command, a single-defect fast path routing command that guides a single bug from ground-truth audit through a TDD fix, verification, a single-concern commit, and opening a PR. It includes the plan document, the source command markdown file, and its generated mirror. The review feedback suggests clarifying the composition sequence in commands/ship.md to explicitly state that the synchronous flow stops at the PR stage and deploy-receipt runs post-merge, preventing potential confusion or infinite waiting by the AI agent.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

The composition sequence lists deploy-receipt immediately after commit-commands:commit-push-pr. However, step 6 of the behavior states that the command stops after opening the PR ("Stop here. The merge is yours"), and deploy-receipt only activates after a merge has landed. To prevent the AI agent from attempting to run deploy-receipt synchronously or waiting indefinitely for a merge during the /ship execution, clarify in the composition list that the synchronous flow stops at the PR stage and deploy-receipt is a post-merge step.

Suggested change

	Routes through, in order: `reconcile` → `tdd-workflow` → `verification-loop` → `commit-commands:commit-push-pr` → `deploy-receipt`. Each step falls back to its inline behavior when the preferred skill is not installed.
	Routes through, in order: `reconcile` → `tdd-workflow` → `verification-loop` → `commit-commands:commit-push-pr` (then stops for operator merge, with `deploy-receipt` running post-merge). Each step falls back to its inline behavior when the preferred skill is not installed.