feat(superpowers): vendor the 7 wired skills at v6.4.1, drop the plugin

plugins.lock.json gains a superpowers entry (obra/superpowers @ 5bf4e78,
path skills, per-skill file lists, always_on) that lib/vendor-skills.sh
fetches byte-for-byte: brainstorming, writing-plans,
subagent-driven-development, test-driven-development,
requesting-code-review, using-git-worktrees, writing-skills. install-plugins
STEP 8e vendors it, update-all refreshes it at the pin, link.sh links the
seven, .gitignore ignores them. The plugin is no longer installed or
protected: its 8 other skills duplicated personal flows and its
SessionStart injection cost ~900 tokens per start, clear and compact.
detect_superpowers is one file test on the linked skill; doctor and
session-start stop charging the injection. doctor-vendored gains an
always_on class (third lock column) so always-on externals are
link-checked instead of reported parked.

update-all.sh

@@ -377,9 +377,10 @@ else
   info "design-motion-principles not installed — skipping"
 fi
 
-# ── 7.3. Update Agent Skills + Mengto scroll skills (pinned commit) ──
-# Both re-fetched at the SAME pinned commit (never advances the pin) via
-# the shared lib/vendor-skills.sh helper — see install-plugins.sh Step 8e.
+# ── 7.3. Update Agent Skills + Mengto scroll skills + superpowers
+# (pinned commit) — all three re-fetched at the SAME pinned commit
+# (never advances the pin) via the shared lib/vendor-skills.sh helper —
+# see install-plugins.sh Step 8e.
 echo ""
 echo "── Updating Agent Skills (addyosmani/agent-skills)..."
 # shellcheck source=lib/vendor-skills.sh disable=SC1091
@@ -388,6 +389,9 @@ vendor_pinned_skills agent-skills refresh
 echo ""
 echo "── Updating Mengto scroll skills (MengTo/Skills)..."
 vendor_pinned_skills mengto-skills refresh
+echo ""
+echo "── Updating superpowers skills (obra/superpowers)..."
+vendor_pinned_skills superpowers refresh
 
 # ── Impeccable (design detector + skill + subagents) ──
 # Global scope: the installer writes through the ~/.claude/{skills,agents}