Retire the command catalogue for generic-argument workflows

[leoncheng57]

Eliminates the repository-owned command catalogue. All 23 files under
agent-skills/commands/ are deleted: 16 become composer workflows through a new
generic argument-taking workflow kind, and 7 are dropped because a same-subject
runtime reminder already said everything they said.

What changed

A workflow can now describe its own field. WorkflowPreset gains an optional
argument spec (label, placeholder, hint, required, maxLength) whose typed
value is the visible prompt, and an optional fixed prompt for a workflow that
collects nothing. server/routes/workflows.ts projects both; WorkflowSummary and the
public-simulator fixture carry both.

The dialog stopped growing id lists. It previously branched on workflow id in four
separate places, and one of those ternaries ended : objective.trim() — an
unrecognized id was silently treated as a Managed Child launch. It now holds one
BESPOKE_WORKFLOW_IDS set naming what is special (the five workflows with real
bespoke fields or their own submit path) plus one sendsIntoThisSession predicate
shared by the submit branch, the apply note and the buttons. An id this build has never
seen degrades to "generic form, sent into this session".

Two deliberate refusals. maxLength is clamped server-side to the prompt route's
own 100,000-character ceiling, so a preset cannot advertise a field the send would
reject. And an optional field left blank is refused rather than sent — the resulting
message would be the trusted injector with nothing to apply it to. Consequently all 16
ported arguments ship required: true; the "no subject supplied" fallback lives in the
injector text, where the agent can act on it.

The preview says what a workflow cannot promise. Every workflow that sends into
this session now shows "Sent in this session's current mode." The ported procedures
could pin their own agent in frontmatter (agent: plan for the read-only ones) and a
workflow carries no declarative mode. Declarative mode was deliberately not added, so
the old guarantee is gone and the UI states that rather than dropping it silently.

standup is the one that could not be ported cleanly. Its three !`…` shell
interpolations were its entire input dataset, and a workflow injector is never
expanded. It now instructs the agent to run those three commands itself and says
plainly that bash is likely denied in a Plan session — pretending the data was
pre-fetched would produce a confident standup written from the transcript.

Six groups, 22 workflows, nothing in Other. Review · Coordinate · Execute · Investigate · Document · Ship. groupWorkflows still appends Other for an id a
newer server ships; a shipped workflow landing there is now a test failure.

Playbooks is workflows-only. The per-project load-state badge, install-command
blocks, ScopeTable, the simulation player and /playbooks/commands* are gone, and
the page no longer calls /api/catalog at all — there is no per-directory installation
question left to ask. The reminder picker's documentation link follows to
/playbooks/workflows/<id> for the 6 reminders whose command survived as a workflow,
and renders nothing for the 6 whose command was deleted rather than converted.

Known breakage — owned by a sibling PR

Deleting agent-skills/commands/ and agent-skills/src/lib/commands.ts leaves the
static-catalogue publisher unable to compile or run:

• npm run typecheck fails on scripts/agent-skills-site.ts (2 errors)
• npm test fails to collect tests/agent-skills-site.test.ts (1 suite)

Both files, plus scripts/generate-agent-skills-site.ts,
scripts/stage-agent-skills-site.ts, scripts/publish-workflow-audit.ts and
.github/workflows/publish-agent-skills.yml, are deliberately untouched here: a
sibling PR retires the command publication pipeline and removes them. Merge that one
with or before this one. Nothing else is red.

Verification run here

Check	Result
npm run typecheck	client + server clean; tools fails only on the sibling-owned publisher
npm test	1123 passed, 2 skipped, 79/80 files — only agent-skills-site fails
npm run test:e2e:docker (full suite)	exit 0 — 413 passed, 1 skipped, 1 pre-existing flake

The Docker lane was used because host ports 3410/4599/4600 were held by a sibling
worktree. The one flake (start DCA session: structured failure…, which counts a
global mock payload list) is pre-existing and passed on retry.

Human verification

Run the stack, open any session in a project.

1. Open the composer Workflows picker. Expect 22 options in 6 groups labelled
   Review, Coordinate, Execute, Investigate, Document, Ship, and a scrollable list.
   Failure signal: a group called "Other", fewer than 22 options, or a list that
   cannot be scrolled to reach "Write a standup update".
2. Search the picker for snippet-by-snippet. Expect exactly one result, "Post a
   snippet-by-snippet PR review". Failure signal: zero results, or the "Nothing is
   sent or launched until you confirm." line disappearing from the panel.
3. Choose "Run the checks, then write verification steps" and leave the field empty.
   Expect one textarea labelled "Surface to verify (required — this text becomes the
   prompt)", focused, with a hint below it, and a disabled "Preview and confirm".
   Failure signal: an enabled Preview button, or no field at all.
4. Type the notification popover on mobile and press Preview and confirm. Expect
   the "Exact prompt" block to contain exactly that sentence and nothing else, the
   trusted injector to show the full verify procedure including its failure table, and
   a line reading "Sent in this session's current mode." naming your current mode.
   Failure signal: a prompt that includes extra generated framing, an injector
   containing the literal text $ARGUMENTS, or a missing mode line.
5. Press "Apply to composer". Expect the dialog to close and the composer draft to
   hold that sentence with the workflow chip attached, and nothing sent.
   Failure signal: a message appearing in the transcript.
6. Reopen the same workflow, fill it again, and press Send. Expect one user message
   in the transcript showing only your typed sentence, with the trusted injector
   rendered separately as an attachment. Failure signal: the raw
   <workflow name="verify"> tag visible inside the user bubble.
7. Switch the composer to Plan, open "Write a standup update", and preview it.
   Expect the injector to contain "Nothing is pre-fetched for you", three literal shell
   commands, and an explicit note that bash is likely denied in a Plan session.
   Failure signal: injector text that presents commit or PR data as already gathered.
8. Open "Launch a Managed Child". Expect the objective textarea, agent buttons and
   model picker exactly as before, and a "Launch Managed Child" button (not "Send").
   Failure signal: a generic argument textarea replacing the managed-child form, or a
   Send button on this workflow.
9. Visit /playbooks. Expect 22 workflow cards in 6 group sections, no "Commands"
   category link, no per-project "Loaded in " badge, and no install commands.
   Failure signal: a Commands nav item, or a 404 on any card link.
10. Open /playbooks/workflows/standup, then press Escape. Expect a modal showing
    "what it asks for" (Scope, required, character bound), the exact injector, and a
    scope note mentioning the current-mode caveat; Escape returns you to
    /playbooks/workflows with focus still inside the document.
    Failure signal: focus landing on <body>, or the modal not closing.
11. Load /playbooks/workflows/verify at 390×740 in light mode. Expect a
    full-bleed modal with no horizontal page scroll and legible (not washed-out)
    injector text. Failure signal: document.documentElement.scrollWidth > 390, or
    near-white text on the dark injector panel.
12. Open the composer Reminder picker. Expect the "Write Human Verification Steps"
    tile to carry an external-link button pointing at /playbooks/workflows/verify,
    and the "Cite File Lines" tile to carry no link at all.
    Failure signal: a link resolving to /playbooks/commands/... (404), or a link on
    a reminder whose command was deleted.

/playbooks
full:/playbooks/workflows
/playbooks/workflows/standup
/sessions/ses_mock_done?directory=/tmp/mock-project
full:/sessions/ses_mock_workflow_main?directory=/tmp/mock-workflow-project