feat(superpowers): vendor the 7 wired skills at v6.4.1, drop the plugin

plugins.lock.json gains a superpowers entry (obra/superpowers @ 5bf4e78,
path skills, per-skill file lists, always_on) that lib/vendor-skills.sh
fetches byte-for-byte: brainstorming, writing-plans,
subagent-driven-development, test-driven-development,
requesting-code-review, using-git-worktrees, writing-skills. install-plugins
STEP 8e vendors it, update-all refreshes it at the pin, link.sh links the
seven, .gitignore ignores them. The plugin is no longer installed or
protected: its 8 other skills duplicated personal flows and its
SessionStart injection cost ~900 tokens per start, clear and compact.
detect_superpowers is one file test on the linked skill; doctor and
session-start stop charging the injection. doctor-vendored gains an
always_on class (third lock column) so always-on externals are
link-checked instead of reported parked.

hooks/session-start.sh

@@ -118,8 +118,9 @@ esac
 
 # Quick passive token cost estimate
 # Only count plugins that are ACTIVE (detected as ON), not just installed
+# superpowers dropped 2026-09-28 (tier 2 of the skill-catalog prune): its
+# 7 vendored skills are counted by the skill catalog, not a plugin cost.
 _passive_t=0
-detect_superpowers 2>/dev/null && _passive_t=$((_passive_t + 800))
 
 # Token costs for toggle plugins — map display name to cost
 declare -A _plugin_costs=(