feat(superpowers): vendor the 7 wired skills at v6.4.1, drop the plugin

plugins.lock.json gains a superpowers entry (obra/superpowers @ 5bf4e78,
path skills, per-skill file lists, always_on) that lib/vendor-skills.sh
fetches byte-for-byte: brainstorming, writing-plans,
subagent-driven-development, test-driven-development,
requesting-code-review, using-git-worktrees, writing-skills. install-plugins
STEP 8e vendors it, update-all refreshes it at the pin, link.sh links the
seven, .gitignore ignores them. The plugin is no longer installed or
protected: its 8 other skills duplicated personal flows and its
SessionStart injection cost ~900 tokens per start, clear and compact.
detect_superpowers is one file test on the linked skill; doctor and
session-start stop charging the injection. doctor-vendored gains an
always_on class (third lock column) so always-on externals are
link-checked instead of reported parked.

lib/vendor-skills.sh

@@ -18,6 +18,9 @@
 # `skills` as a bare list defaults every named skill to `["SKILL.md"]` and
 # `path` to "skills" (the agent-skills shape); `skills` as a dict carries an
 # explicit per-skill file list (references/*, etc.) and `path` is required.
+# `"always_on": true` (optional) is ignored by this helper (fetch is the
+# same either way) — lib/doctor-vendored.sh reads it to expect the
+# entry's skills linked regardless of the active profile.
 #
 # Raw URL: https://raw.githubusercontent.com/<owner>/<repo>/<sha>/<path>/
 # <skill>/<file>. VENDOR_BASE_URL overrides the "https://…/<repo>" prefix