Adopt reviewed GapSet workflow

[raghubetina]

Summary

• prepare plugin 0.2.0 for CLI 0.2.0 and Service API >=0.3.0 <0.4.0
• bind the coordinated analyzer and Compiler identities to reviewed-gap-set-v3 while retaining the firstdraft.foundation-gaps/2 document format
• surface and review the complete canonical GapSet plus digest while making clear that valid covers only the admitted graph
• preserve exact-Head conditional semantics without adding a gap acknowledgment, digest echo, flag, request field, or extra Compile ceremony
• exercise approved valid-with-gaps behavior through a nonempty Appearance GapSet and zero-flag Compile
• sync the bundled schema and target/support guidance, name the retained Plan and GapSet artifact authorities, and document the package-first API 0.3 rollout order
• pin merged CLI main and extend cross-repository checks for same-generation/different-Head replacement and the 128 MiB status response bound

Exact candidate

• Skills base: 638264b9bc225471c7238b9694116e37f7016937
• Skills head: a4a66829a41ba7ef878f152141135575a41b8a9f
• Skills tree: 170b2d7d2438bf85ebd931323bc9b325c1330f3f
• plugin package: @firstdraft.com/claude-code@0.2.0
• pinned-toolchain tarball SHA-256: c3e87bb450630f04da9c6f724045784a4396f0e41222bab9f6ac5297273b0313
• analyzer release: foundation-plan-rails/application-2026-08-22-reviewed-gap-set-v3
• Compiler release: foundation-plan-rails/compiler-application-2026-08-22-reviewed-gap-set-v3
• GapSet document format: firstdraft.foundation-gaps/2
• CLI main: 5ac300f1a2e7262c56473de270a0bd140f169c25
• CLI tree: 3884cfd9532e93c489a9fecd883c166e43dd0dc2
• CLI runtime SHA-256: 5fac5209f06406fcedde85c1ee46f0b539e95e96bb3369330a137e2137e70fcc

Verification

Using pinned Node 24.18.0 and npm 11.16.0:

• npm ci --ignore-scripts
• sh script/check — 70/70 tests
• node script/check-cli-contract.mjs /path/to/exact-cli
• node script/check-claude-plugin-package.mjs --cli-root /path/to/exact-cli
• npm audit — 0 vulnerabilities
• node script/check-plugin-release-order.mjs --prospective
• gh skill publish --dry-run
• independent bounded repin review — no material findings

The tarball digest is bound to the repository-pinned release toolchain; an ambient older npm produced different archive bytes and was not used for the candidate identity.

This PR does not publish either npm package, move a dist-tag, change the public catalog, deploy Service API 0.3, or activate its maintenance-window cutover.

[raghubetina]

Hosted CI reached the intended cross-repository provenance gate and stopped because pinned CLI d24dfcd2d4e36f298f66364e24ad8aaa3aafa4e3 is not yet an ancestor of CLI main; it currently remains on CLI PR #27. All earlier Skills checks in both jobs passed. The gate should remain fail-closed. Merge and reconcile the CLI companion first, then rerun this PR's CI so the exact contract and deterministic package checks can execute against main-reachable CLI bytes.

[raghubetina]

Updated the coordinated candidate to the reviewed GapSet v3 release identities while retaining the firstdraft.foundation-gaps/2 document format.

Exact amended candidate:

• head: 695ddf7146b1cd70bcd2367a8e5338d50c03da2f
• tree: 1873fdac3cee9cc8e6dec888424715a141360a8b
• pinned-toolchain package SHA-256: 16013737a1aadcaeeb440a1beeccf53a26ac2304a63ccf63a5b122a08c9db8e2
• analyzer release: foundation-plan-rails/application-2026-08-22-reviewed-gap-set-v3
• Compiler release: foundation-plan-rails/compiler-application-2026-08-22-reviewed-gap-set-v3

The canonical fixture GapSet digests were regenerated because the release identities are part of the GapSet bytes. Pinned sh script/check is green (70/70); exact CLI contract/package checks, npm audit, Skill Creator validation, and gh skill publish --dry-run are also green.

The CLI-main ancestry gate remains intentionally unchanged. Hosted CI is expected to remain blocked at that gate until the exact CLI candidate in firstdraft/cli#27 is on CLI main. No merge or publication was performed.