refactor(pipeline): specs/plans are gitignored working files, never committed

Per-cycle specs and plans stop being git-tracked commit-then-git-rm
artefacts and become git-ignored working files: created on disk for the
active cycle, read across sessions from the working tree, and shell-rm'd
at cycle close by audit. Nothing is committed, so there is no
git-history copy — the durable record of a cycle's intent is the design
ledger only, and no durable artefact (code, test, doc, ledger) may cite
a spec/plan by number or path.

- conventions/pipeline/design/README: invert the git-tracked -> git-rm
  -> git-history-recovery model to gitignored -> shell-rm -> ledger-only.
- naming: drop the NNNN file counter; files are slug.md (fieldtest specs
  keep a fieldtest- prefix as the cycle-close discriminator).
- cycle number: separated from the (now-gone) file number, sourced from
  the feat(NNNN)/audit(NNNN) commit subjects, which cycle commits carry.
- specify/planner/fieldtest/fieldtester: no commit step; fieldtest splits
  fixtures (committed as code) from its spec (gitignored), with the
  cross-cycle rule that a fieldtest- spec belongs to the next cycle.
- boss: auto-sign auditability moves from the (boss-signed) commit
  subject to the run's reference issue; rollback reverts only code.
- audit: new Step 5 shell-rm's the cycle spec+plan after the architect
  reads them, sparing fieldtest- specs.

Companion machine config (outside this repo): the global git excludes
(~/.config/git/ignore) gains docs/specs/ and docs/plans/ so the ignore
applies to every project at once.

docs/pipeline.md

@@ -140,8 +140,9 @@ Hard-gate before plan — the spec-production core and the carrier of the
 "no plan without an approved spec" invariant. Takes a settled design
 (directly from sources, or a ratified design handed over by
 `brainstorm`), applies the feature-acceptance criterion, writes the
-spec to `docs/specs` (an ephemeral active-cycle artefact, git-tracked
-and `git rm`'d at cycle close — see `conventions.md` § Lifecycle), runs
+spec to `docs/specs` (an ephemeral active-cycle working file —
+git-ignored, never committed, shell-`rm`'d at cycle close — see
+`conventions.md` § Lifecycle), runs
 the `grounding-check` gate, and takes sign-off — with review but no
 interview. Under the bold stance it decides every load-bearing fork it
 can *derive* an answer for and records the decision in the run's
@@ -152,9 +153,11 @@ gate before `planner` on every design path.
 Outside `/boss` the sign-off is the user's. Under `/boss` the autonomous
 signature is the **`grounding-check` `PASS`** itself: an independent
 fresh-context agent's verdict against currently-green tests, not the
-orchestrator's confidence. On `PASS` the orchestrator commits the spec
-(subject `(boss-signed)`), fires the vetoable auto-sign notify, and
-continues to `planner`; a no-override grounding `BLOCK` / `INFRA_ERROR`
+orchestrator's confidence. On `PASS` the orchestrator keeps the signed
+spec as a git-ignored working file (never committed), records the
+autonomous sign on the run's reference issue, fires the vetoable
+auto-sign notify, and continues to `planner`; a no-override grounding
+`BLOCK` / `INFRA_ERROR`
 routes to the human sign-off pause. The former obligatory five-lens
 `spec-skeptic` panel is **retired** (baseline tag `pre-autosign-rework`):
 the judgement it applied now lives upstream in Step 1.5's bold-decide
@@ -167,9 +170,10 @@ See `../specify/SKILL.md` Step 6 and `../boss/SKILL.md` §"Spec auto-sign".
 ### planner
 
 Hard-gate before implement. Produces a placeholder-free,
-bite-sized implementation plan in `docs/plans` (ephemeral, retired
-alongside the spec at cycle close — see `conventions.md` § Lifecycle)
-that the implement skill can execute task-by-task. Dispatches
+bite-sized implementation plan in `docs/plans` (an ephemeral,
+git-ignored working file, shell-`rm`'d alongside the spec at cycle
+close — see `conventions.md` § Lifecycle) that the implement skill can
+execute task-by-task. Dispatches
 the plan-recon agent for read-only file-structure mapping.
 
 ### implement
@@ -209,9 +213,11 @@ review-and-commit discipline; the orchestrator inspects and commits.
 Runs at cycle close. Dispatches the architect agent (read-only
 drift review against the design ledger) and the bencher agent
 (regression diagnostics). Reports drift and regress. Once it is
-drift-clean, the orchestrator retires the cycle's spec and plan —
-`git rm`'ing them in the cycle-close commit (see `conventions.md`
-§ Lifecycle).
+drift-clean, the orchestrator discards the cycle's spec and plan with a
+plain shell `rm` (nothing to `git rm` — they were never committed),
+sparing any `fieldtest-`-prefixed spec (it belongs to the next cycle);
+the cycle-close commit contains only code and ledger changes (see
+`conventions.md` § Lifecycle).
 
 ### debug