[v3.7.0] feat: sin-code superpowers — obra/superpowers integration with supply-chain pinning

[Delqhi]

Goal

Integrate the obra/superpowers skills library (MIT, https://github.com/obra/superpowers) into SIN-Code as a top-level subcommand. Skills are cloned from upstream, pinned to a reviewed commit SHA, overlaid with SIN-Code tool mappings, and served as MCP tools.

Why

obra/superpowers is the de-facto standard for methodology skills (TDD, systematic-debugging, subagent-driven-development, verification-before-completion, writing-plans, brainstorming, requesting-code-review, finishing-a-development-branch, using-git-worktrees). Each skill enforces a workflow that maps directly onto SIN-Code's mandates: M3 (verify-before-completion → sin_preflight + verify_tests + prove), M6 (SIN tools over naive builtins), M7 (race-free agent loop).

Scope (already implemented on feat/v3.7.0-superpowers-integration)

1. cmd/sin-code/internal/superpowers/superpowers.go — Install/Update/Pin + supply-chain lock (upstream.lock)
2. cmd/sin-code/internal/superpowers/frontmatter.go — full YAML parser (>– and |– block scalars, indented continuations)
3. cmd/sin-code/internal/superpowers/overlay.go — idempotent SIN-Code tool mapping (base + skill-specific)
4. cmd/sin-code/internal/superpowers/mcpserver.go — minimal stdio MCP server, 3 tools (list/find/use)
5. cmd/sin-code/internal/superpowers/prompt.go — Superpowers prompt block injection into AGENTS.md
6. cmd/sin-code/superpowers_cmd.go — CLI: install, update [--yes], pin , list, show, find, serve, init, doctor
7. cmd/sin-code/internal/superpowers/superpowers_test.go — tests including local-fixture pinning test (no network)

Design decisions

• Overlay instead of fork: upstream skills stay pristine; the SIN-Code mapping is appended in a marked block. git pull never breaks the integration.
• Pinned SHA: sin-code superpowers install records the current upstream HEAD in upstream.lock. sin-code superpowers update requires update --yes after showing the diff. The 12-factor 'review before trust' principle applied to skill content (which flows into agent context).
• Idempotent everywhere: install, init, RegisterMCP are all re-runnable without corruption.
• Test-only stdlib: no CGo, no external deps (consistent with M2).

Definition of done

• All 8 files present, race-clean under -count=3
• Coverage ≥80% on the new files
• sin-code superpowers install clones obra/superpowers, writes the lock, applies overlays, registers in mcp.json
• sin-code superpowers find 'fix the failing test' returns the relevant skill
• sin-code superpowers update shows the diff before applying
• sin-code mcp status shows the superpowers server as up with 3 tools

Cross-refs

• AGENTS.md §5 (ecosystem map) — superpowers now in the MCP skill layer
• AGENTS.md §3 mandates M3, M6, M7 — enforced by overlay + tests
• v3.6.0 ([v3.6.0] feat: WebUI-v2 backend API (sessions/knowledge/chat-with-SSE) #52) WebUI-v2 HTTP API — chat endpoint consumes superpowers tool output via MCP