feat(profile): partition skills/plugins/MCPs/CLIs by usage profile

Ship lib/profile.sh + 9 profiles in lib/profiles/. A profile is a
plain-text file listing items + types (gstack | personal | external |
plugin@<marketplace> | mcp | cli). `profile set <name>` enables the
listed items and disables the rest:

  - gstack/personal/external skills: symlink toggle skills/ ↔
    skills-disabled/ (gstack__<name> prefix to avoid collisions; no
    prefix for personal/external).
  - plugins typed `plugin@<marketplace>`: actually toggled via
    `claude plugin enable|disable <name>@<marketplace>`. Allowlist:
    MANAGED_PLUGINS = ui-ux-pro-max, plugin-dev, pr-review-toolkit.
    Denylist: PROTECTED_PLUGINS = caveman, security-guidance,
    superpowers (always-on, never disabled even if absent from a
    profile).
  - mcp magic: delegated to lib/toggle-external.sh which already
    handles the MAGIC_API_KEY env lookup. Other MCPs stay advisory.
  - cli (rtk, gsd, ctx7, graphify): status-only, never auto-installed.

Profiles shipped:
  web        public website work — frontend + content + light dev
  seo        SEO + GEO + W3C audit (search/AI indexability + a11y)
  web-full   production website end-to-end (web ∪ seo ∪ qa-only/canary)
  backend    backend / API / system dev — no design, no SEO
  design     visual QA, design systems, mockups, polish
  dev        daily code work — features, fixes, refactor, ship
  qa         site testing, perf, canary, validation
  audit      comprehensive audit — security + SEO + perf + health
  minimal    strip all gstack skills (quiet session)

Commands:
  profile list / show <name> / current / apply <name> / set <name> /
  reset / diff <a> <b>

`current` heuristic returns "full" when nothing is disabled, otherwise
picks the profile with the highest available-ratio (counts both
"enabled" and "installed" — the latter for CLIs). Tiebreaker: larger
profile total wins, so web-full beats web at a 100% tie.

`reset` re-enables every gstack skill but does NOT touch plugins —
the user re-enables a managed plugin manually or via `apply <profile>`.
This is documented in the trailing info line.

Integration:
  - skills/profile/SKILL.md — `/profile` slash command, lists profiles,
    documents the per-type mechanism, points at lib/profile.sh.
  - agents/plugin-advisor.md — DETECT phase calls `profile current`,
    OUTPUT adds a PROFILE line, and TOGGLING EXTERNAL TOOLS gains a
    "Skill profiles" section with a signal → profile recommendation
    table.
  - lib/toggle-external.sh — header pointer to profile.sh for fine-
    grained activation (toggle-external still owns whole-gstack and
    magic-MCP toggles).
  - Makefile — `make profile cmd="set <name>"`, profile-list,
    profile-current, profile-reset.

Tested end-to-end: `set web` enables ui-ux-pro-max + magic; `set seo`
disables ui-ux-pro-max; `set minimal` disables ui-ux-pro-max but
spares always-on plugins; `reset` restores all 64 skills; shellcheck
clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

agents/plugin-advisor.md

@@ -23,6 +23,11 @@ claude plugin list 2>/dev/null || echo "plugin-list-unavailable"
 # `claude plugin enable|disable` does not apply to them.
 bash "$HOME/.claude/lib/toggle-external.sh" list 2>/dev/null || echo "toggle-external-unavailable"
 
+# Active skill profile — design / dev / qa / audit / minimal / custom.
+# Profiles partition gstack + personal skills by purpose. See
+# lib/profile.sh and lib/profiles/*.profile.
+bash "$HOME/.claude/lib/profile.sh" current 2>/dev/null || echo "profile-unavailable"
+
 # Context7 CLI
 command -v ctx7 &>/dev/null && ctx7 --version 2>/dev/null | head -1 || echo "ctx7-not-installed"
 
@@ -114,6 +119,7 @@ Output: `COMPLEXITY: <score>% — <label>` with one-line justification.
 ```
 PLUGIN CHECK
 ACTIVE: [plugin — status, one line each]
+PROFILE: [active skill profile — name + match%, or "custom"]
 SIGNALS: [detected signals]
 COMPLEXITY: <score>% — <simple|moderate|complex|enterprise>
 PLAN: <Max|Pro|Free> (budget: ~<N>t passive tokens)
@@ -308,6 +314,40 @@ bash $HOME/.claude/lib/toggle-external.sh enable gstack
 bash $HOME/.claude/lib/toggle-external.sh disable darwin-skill
 ```
 
+### Skill profiles (fine-grained partitioning, with plugin + MCP toggle)
+
+For task-shaped activation (web only, seo only, backend only, design only,
+etc.) prefer `lib/profile.sh` over toggling all of gstack at once. Profiles
+activate a curated subset of skills + plugins + MCPs and disable the rest of
+gstack + managed plugins — sessions stay focused and passive token cost drops.
+
+`profile set <name>` actually toggles plugins (`claude plugin enable|disable`)
+and MCPs (delegates to `lib/toggle-external.sh` for `magic`) — not just
+advisory. Always-on plugins (`caveman`, `security-guidance`, `superpowers`)
+are protected. Managed plugins that `set` may toggle:
+`ui-ux-pro-max@ui-ux-pro-max-skill`, `plugin-dev@claude-code-plugins`,
+`pr-review-toolkit@claude-code-plugins`. Other plugins are never auto-toggled.
+
+When the project signal matches one of the canonical profiles, recommend the
+matching `profile set` command:
+
+| Signal | Recommended profile | Command |
+|---|---|---|
+| `frontend` public website (no backend, no SEO focus) | `web` | `bash $HOME/.claude/lib/profile.sh set web` |
+| audit-only: SEO + GEO + W3C + WCAG | `seo` | `bash $HOME/.claude/lib/profile.sh set seo` |
+| public website end-to-end (build + audit) | `web-full` | `bash $HOME/.claude/lib/profile.sh set web-full` |
+| backend / API / system / library (no UI, no SEO) | `backend` | `bash $HOME/.claude/lib/profile.sh set backend` |
+| `design-system` (heavy UI work, no dev) | `design` | `bash $HOME/.claude/lib/profile.sh set design` |
+| `simple` / hotfix / typical dev session | `dev` | `bash $HOME/.claude/lib/profile.sh set dev` |
+| `browser-qa` (e2e tests, no design work) | `qa` | `bash $HOME/.claude/lib/profile.sh set qa` |
+| comprehensive audit (security + SEO + perf) | `audit` | `bash $HOME/.claude/lib/profile.sh set audit` |
+| narrow session, minimal noise | `minimal` | `bash $HOME/.claude/lib/profile.sh set minimal` |
+
+To restore the full skill set: `bash $HOME/.claude/lib/profile.sh reset`.
+Plugin state is NOT touched by reset — re-enable a managed plugin manually
+or by applying a profile that lists it (e.g. `apply web` to restore
+`ui-ux-pro-max`).
+
 ## BLOCK if
 
 - Superpowers not active → install: `claude plugin marketplace add obra/superpowers-marketplace && claude plugin install --scope user superpowers@superpowers-marketplace`