feat(superpowers): vendor the 7 wired skills at v6.4.1, drop the plugin

plugins.lock.json gains a superpowers entry (obra/superpowers @ 5bf4e78,
path skills, per-skill file lists, always_on) that lib/vendor-skills.sh
fetches byte-for-byte: brainstorming, writing-plans,
subagent-driven-development, test-driven-development,
requesting-code-review, using-git-worktrees, writing-skills. install-plugins
STEP 8e vendors it, update-all refreshes it at the pin, link.sh links the
seven, .gitignore ignores them. The plugin is no longer installed or
protected: its 8 other skills duplicated personal flows and its
SessionStart injection cost ~900 tokens per start, clear and compact.
detect_superpowers is one file test on the linked skill; doctor and
session-start stop charging the injection. doctor-vendored gains an
always_on class (third lock column) so always-on externals are
link-checked instead of reported parked.

lib/detect-plugins.sh

@@ -16,14 +16,10 @@ detect_rtk() {
 }
 
 detect_superpowers() {
-  # Fast check: filesystem (plugin cache)
-  local cache_dir="$HOME/.claude/plugins/cache"
-  if [ -d "$cache_dir" ]; then
-    compgen -G "$cache_dir"/*superpowers* &>/dev/null && return 0
-  fi
-  # Slow fallback: CLI (only if fast check fails)
-  claude plugin list 2>/dev/null | grep -qi "superpowers" && return 0
-  return 1
+  # superpowers = 7 vendored skills since 2026-09-28; the plugin is gone.
+  # One file test on the linked vendored skill: proves vendored AND
+  # linked in one shot — no plugin cache glob, no `claude plugin list`.
+  [ -f "$HOME/.claude/skills/brainstorming/SKILL.md" ]
 }