refactor(pipeline): specs/plans are gitignored working files, never committed

Per-cycle specs and plans stop being git-tracked commit-then-git-rm
artefacts and become git-ignored working files: created on disk for the
active cycle, read across sessions from the working tree, and shell-rm'd
at cycle close by audit. Nothing is committed, so there is no
git-history copy — the durable record of a cycle's intent is the design
ledger only, and no durable artefact (code, test, doc, ledger) may cite
a spec/plan by number or path.

- conventions/pipeline/design/README: invert the git-tracked -> git-rm
  -> git-history-recovery model to gitignored -> shell-rm -> ledger-only.
- naming: drop the NNNN file counter; files are slug.md (fieldtest specs
  keep a fieldtest- prefix as the cycle-close discriminator).
- cycle number: separated from the (now-gone) file number, sourced from
  the feat(NNNN)/audit(NNNN) commit subjects, which cycle commits carry.
- specify/planner/fieldtest/fieldtester: no commit step; fieldtest splits
  fixtures (committed as code) from its spec (gitignored), with the
  cross-cycle rule that a fieldtest- spec belongs to the next cycle.
- boss: auto-sign auditability moves from the (boss-signed) commit
  subject to the run's reference issue; rollback reverts only code.
- audit: new Step 5 shell-rm's the cycle spec+plan after the architect
  reads them, sparing fieldtest- specs.

Companion machine config (outside this repo): the global git excludes
(~/.config/git/ignore) gains docs/specs/ and docs/plans/ so the ignore
applies to every project at once.

boss/SKILL.md

@@ -538,10 +538,13 @@ pause. The boss-side contract is just this:
   verifies. Editorial roughness the old panel would have caught is let
   through deliberately — cheap to patch inline downstream, never worth an
   obligatory five-juror panel on every spec.
-- **On a clean sign, do not stop.** Commit the spec (the auto-sign
-  commit subject carries `(boss-signed)` so the act is auditable in
-  history), fire the auto-sign notify, and continue to `planner` in
-  the same run. The notify is informational-with-veto, not a pause.
+- **On a clean sign, do not stop.** The spec is never committed — it is
+  a git-ignored working file, signed by the `grounding-check` PASS.
+  Make the sign auditable on the run's **reference issue** (a
+  decision-log comment recording that the spec was auto-signed on a
+  PASS with no human), fire the auto-sign notify, and continue to
+  `planner` in the same run. The notify is informational-with-veto, not
+  a pause.
 - **The notify must be vetoable.** It follows the same editorial rules
   as a done-state notify (English, user-as-reader, no iteration codes
   or crate names) with one addition forced by its purpose: it must
@@ -552,15 +555,18 @@ pause. The boss-side contract is just this:
   capability> myself and started the implementation plan — reply to
   veto." No internals, but enough identity to act on.
 - **A veto is a forward correction — or, within the run, a rollback.**
-  If the user vetoes a spec already committed below the session anchor
-  (ratified history), undo it forward
-  — revert the spec commit, discard the downstream working-tree work with
-  `git checkout`, file the redirection. *Within* the autonomous run, the
-  rollback sandbox (§ Direction freedom) is the additional remedy: the
-  orchestrator may hard-reset its own unpushed `(boss-signed)` commit and
-  the work built on it back toward the session anchor when it judges the
-  fork was wrong — its own work only, never below the anchor, never a
-  pushed commit.
+  The spec is never a commit (it is a git-ignored working file), so a
+  veto is undone forward by shell-`rm`ing (or editing) the spec and
+  reverting only the downstream **code** it produced: `git revert` the
+  code commits below the session anchor (ratified history), or
+  `git checkout` the unstaged work, and file the redirection. *Within*
+  the autonomous run, the rollback sandbox (§ Direction freedom) is the
+  additional remedy: the orchestrator may hard-reset its own unpushed
+  autonomous **code** commits and the work built on them back toward the
+  session anchor when it judges the fork was wrong — its own work only,
+  never below the anchor, never a pushed commit — and shell-`rm`s the
+  git-ignored spec/plan of the abandoned line. The reference-issue thread
+  is the only surviving trace of the abandoned attempt.
 
 ## Skill-system feedback