feat(specify): bound the auto-sign panel with an editorial self-correction loop

The spec-skeptic auto-sign panel was one-shot: under /boss with
spec_auto_sign on, any panel BLOCK fell straight back to the human
sign-off pause. Because the panel is adversarial-by-design and rarely
returns a unanimous SOUND, /boss escalated to the user even for defects
the orchestrator could mechanically repair.

Partition the five lenses by what a BLOCK means and run Step 6 as a
bounded loop:

- Editorial (criterion, ambiguity, plan-readiness) — the spec is
  under-articulated; the orchestrator self-corrects in place, re-runs
  Step 4 + Step 5, and re-dispatches all five lenses.
- Design (scope-fork, grounding) — the ground is not settled; escalate,
  never self-correct.

Re-loop limit: <= 2 rounds, the 3rd unresolved editorial BLOCK
escalates (hard-coded N, matching implement-orchestrator's idiom).
INFRA_ERROR and exhausted budget escalate too. Auto-sign still requires
a fresh unanimous SOUND on a green objective gate.

Re-dispatching all five lenses every round is the backstop: an
editorial repair that launders an unsourced design decision is caught
by the re-run scope-fork / grounding jurors and escalates. A criterion
repair is bounded to supplying the worked evidence the criterion already
demands — not re-judging acceptance (architect drift item).

specify/SKILL.md owns the loop; spec-skeptic.md keeps the juror
lens-agnostic; boss/SKILL.md, README.md, docs/profile-schema.md and
docs/pipeline.md are synced to the new semantics.

closes #6

docs/pipeline.md

@@ -109,7 +109,11 @@ one exception is the opt-in `pipeline.boss.spec_auto_sign` slot: with
 it on, a `/boss` run may sign a spec in the user's place — but only
 when every objective gate is green AND a unanimous five-lens
 `spec-skeptic` panel passes; the orchestrator's own confidence never
-signs. Any juror `BLOCK` falls back to the human sign-off pause. See
+signs. A `BLOCK` is never signed over: an editorial one (`criterion` /
+`ambiguity` / `plan-readiness`) is repaired in a bounded ≤ 2-round loop
+that re-runs the objective gates and re-dispatches all five lenses each
+round; a design one (`scope-fork` / `grounding`), an `INFRA_ERROR`, or
+an exhausted budget falls back to the human sign-off pause. See
 `../specify/SKILL.md` Step 6 and `../boss/SKILL.md` §"Spec auto-sign".
 
 ### planner

docs/profile-schema.md

@@ -229,10 +229,15 @@ user-review gate for the user's signature, exactly as before. With it
 **on**, the orchestrator may sign a spec in the user's place, but only
 through `specify`'s auto-sign gate: every objective gate green
 (precondition, parse, a `grounding-check` `PASS` with no human
-override) AND a unanimous five-lens `spec-skeptic` panel. A single
-juror `BLOCK`, or any objective gate not green, falls back to the
-human sign-off pause. Model self-confidence alone never signs — the
-gate is built specifically not to rely on it. On a clean sign the
+override) AND a unanimous five-lens `spec-skeptic` panel. A `BLOCK` is
+never signed over: an *editorial* one (`criterion` / `ambiguity` /
+`plan-readiness`) the orchestrator repairs in a bounded loop (≤ 2
+rounds, re-running the objective gates and re-dispatching all five
+lenses each round), while a *design* one (`scope-fork` / `grounding`),
+an `INFRA_ERROR`, any objective gate not green, or an exhausted budget
+falls back to the human sign-off pause. Model self-confidence alone
+never signs — the gate is built specifically not to rely on it. On a
+clean sign the
 orchestrator commits the spec (subject carries `(boss-signed)`), sends
 the mandatory informational-with-veto notify, and continues to
 `planner` without stopping. See `../specify/SKILL.md` Step 6 (gate