feat(superpowers): vendor the 7 wired skills at v6.4.1, drop the plugin

plugins.lock.json gains a superpowers entry (obra/superpowers @ 5bf4e78,
path skills, per-skill file lists, always_on) that lib/vendor-skills.sh
fetches byte-for-byte: brainstorming, writing-plans,
subagent-driven-development, test-driven-development,
requesting-code-review, using-git-worktrees, writing-skills. install-plugins
STEP 8e vendors it, update-all refreshes it at the pin, link.sh links the
seven, .gitignore ignores them. The plugin is no longer installed or
protected: its 8 other skills duplicated personal flows and its
SessionStart injection cost ~900 tokens per start, clear and compact.
detect_superpowers is one file test on the linked skill; doctor and
session-start stop charging the injection. doctor-vendored gains an
always_on class (third lock column) so always-on externals are
link-checked instead of reported parked.

.gitignore

@@ -74,6 +74,15 @@ skills/scroll-scrubbed-visual-sequence
 skills/scroll-scrubbed-word-reveal
 skills/scroll-progress-timeline
 
+# superpowers, vendored (plugins.lock.json 'superpowers')
+skills/brainstorming
+skills/writing-plans
+skills/subagent-driven-development
+skills/test-driven-development
+skills/requesting-code-review
+skills/using-git-worktrees
+skills/writing-skills
+
 # Impeccable — NOT a symlink: `impeccable skills install --scope=global`
 # writes the skill dir (and its ~15 MB engine binary) straight in through the
 # ~/.claude/skills symlink. Machine-owned, regenerated by make plugin/update.
@@ -206,6 +215,20 @@ skills-external/scroll-scrubbed-visual-sequence/
 skills-external/scroll-scrubbed-word-reveal/
 skills-external/scroll-progress-timeline/
 
+# superpowers, vendored (plugins.lock.json 'superpowers') — machine-owned,
+# curl'd at the commit pinned in plugins.lock.json by install-plugins.sh
+# Step 8e (when absent) and re-fetched at the SAME commit by update-all.sh,
+# through the shared lib/vendor-skills.sh helper. Not vendored: this is a
+# pin, not a tracked snapshot — bump the commit deliberately to pick up an
+# upstream edit.
+skills-external/brainstorming/
+skills-external/writing-plans/
+skills-external/subagent-driven-development/
+skills-external/test-driven-development/
+skills-external/requesting-code-review/
+skills-external/using-git-worktrees/
+skills-external/writing-skills/
+
 # 21st.dev skill pack — machine-owned: `21st skills install` output, staged by
 # install-plugins.sh Step 8.7 (the installer refuses to write through the
 # ~/.claude/skills symlink, so it runs under a throwaway HOME and the skills