feat(specify): bound the auto-sign panel with an editorial self-correction loop

The spec-skeptic auto-sign panel was one-shot: under /boss with
spec_auto_sign on, any panel BLOCK fell straight back to the human
sign-off pause. Because the panel is adversarial-by-design and rarely
returns a unanimous SOUND, /boss escalated to the user even for defects
the orchestrator could mechanically repair.

Partition the five lenses by what a BLOCK means and run Step 6 as a
bounded loop:

- Editorial (criterion, ambiguity, plan-readiness) — the spec is
  under-articulated; the orchestrator self-corrects in place, re-runs
  Step 4 + Step 5, and re-dispatches all five lenses.
- Design (scope-fork, grounding) — the ground is not settled; escalate,
  never self-correct.

Re-loop limit: <= 2 rounds, the 3rd unresolved editorial BLOCK
escalates (hard-coded N, matching implement-orchestrator's idiom).
INFRA_ERROR and exhausted budget escalate too. Auto-sign still requires
a fresh unanimous SOUND on a green objective gate.

Re-dispatching all five lenses every round is the backstop: an
editorial repair that launders an unsourced design decision is caught
by the re-run scope-fork / grounding jurors and escalates. A criterion
repair is bounded to supplying the worked evidence the criterion already
demands — not re-judging acceptance (architect drift item).

specify/SKILL.md owns the loop; spec-skeptic.md keeps the juror
lens-agnostic; boss/SKILL.md, README.md, docs/profile-schema.md and
docs/pipeline.md are synced to the new semantics.

closes #6

README.md

@@ -149,14 +149,21 @@ never on its own confidence. Signing requires two stages to clear:
   `grounding`, `scope-fork`, `ambiguity`, `plan-readiness`), each
   trying to *refute* the spec. All five must return `SOUND`.
 
-A single juror `BLOCK`, or any objective gate not green, falls back to
-the human sign-off pause the spec would have hit anyway. On a clean
-sign the orchestrator commits the spec (`(boss-signed)` in the
-subject), sends a mandatory informational notify that names the signed
-capability and invites a veto, and continues to `planner` without
-stopping. A later veto is a forward correction, never a history
-rewind. See `specify/SKILL.md` Step 6, `specify/agents/spec-skeptic.md`,
-and `boss/SKILL.md` §"Spec auto-sign".
+A `BLOCK` is never signed over. The five lenses split by what a `BLOCK`
+means: an *editorial* one (`criterion`, `ambiguity`, `plan-readiness` —
+the spec is under-articulated) the orchestrator repairs in a bounded
+loop (edit, re-run the objective gates, re-dispatch all five lenses, up
+to 2 rounds); a *design* one (`scope-fork`, `grounding` — the ground is
+not settled), an `INFRA_ERROR`, any objective gate not green, or an
+exhausted budget falls back to the human sign-off pause the spec would
+have hit anyway. Re-dispatching all five lenses every round is the
+backstop that stops an editorial repair from quietly settling a design
+question. On a clean sign the orchestrator commits the spec
+(`(boss-signed)` in the subject), sends a mandatory informational notify
+that names the signed capability and invites a veto, and continues to
+`planner` without stopping. A later veto is a forward correction, never
+a history rewind. See `specify/SKILL.md` Step 6,
+`specify/agents/spec-skeptic.md`, and `boss/SKILL.md` §"Spec auto-sign".
 
 ## Install