feat(pipeline): consolidate cycle recon, add fieldtest probe tier, enforce assumption economy

Implements the three efficiency findings from the #310 pipeline
measurement (refs #35): ~691k subagent tokens / ~3.5 h for a
deliberately small cycle, with recon duplication as the single
biggest obligatory per-cycle cost.

1. Cycle recon (pipeline.md § Cycle recon; specify, planner,
   brainstorm, boss, plan-recon): recon fan-out is budgeted per
   cycle, not per phase. One full plan-recon dispatch — normally
   specify Step 1, in a new pre-spec sources/recon_scope carrier
   form — serves both the spec's concrete code shapes and the
   plan's file-map. planner Step 2 becomes reuse-first (freshness /
   quotability / coverage conditions) with narrowly-bounded delta
   dispatches (new Delta dispatch contract in plan-recon.md);
   broad Explore-type grounding sweeps are banned in every mode.
   Field evidence: 151k (Explore) + 99k (plan-recon) with ~40 %
   overlap in one bounded cycle.

2. Fieldtest probe tier (fieldtest, fieldtester, pipeline.md,
   agent-template.md § model rule 2): a cycle whose user-visible
   delta is a single narrow axis dispatches the per-cycle
   fieldtest at tier: probe — 1-2 examples on exactly that axis,
   ~200-word report, explicit model:sonnet dispatch override (no
   dispatch-level effort override exists; frontmatter effort
   applies). Probe is a tier, not a skip; the milestone fieldtest
   always runs full tier on the frontmatter model, keeping the
   milestone-close gate's >=2-example floor unconditional.

3. Assumption economy (specify Step 3 + self-review item 6):
   grounding-check cost scales with the spec's assumption count,
   so specs state current-behaviour claims only where the change
   relies on them (the gate's own falsity test), demote
   context-only mentions to ledger citations, and keep iteration
   scope tight — fewer restatements, never fewer reliances. The
   gate itself is unchanged.

Design reviewed pre-implementation (opus plan review); diff
adversarially verified by a 3-lens review workflow (consistency,
operability, cross-reference), confirmed findings folded in.

refs #35

brainstorm/SKILL.md

@@ -152,8 +152,9 @@ unconditional default.
 ### Step 3 — Populate the space with the synthetic-user swarm
 
 Dispatch the read-only `agents/synthetic-user.md` agent **in parallel, one per
-stance, in a single turn** — the same ad-hoc fan-out brainstorm already uses
-for `plan-recon` and `specify` uses for `spec-skeptic`. No Workflow wrapper: a
+stance, in a single turn** — the same ad-hoc fan-out `specify` uses
+for `spec-skeptic`. (brainstorm's ad-hoc `plan-recon` is a SINGLE dispatch,
+never a fan-out — `../docs/pipeline.md` § Cycle recon.) No Workflow wrapper: a
 one-shot stateless fan-out has no re-loop, no ordering, and no in-code verdict
 to enforce, so it is a direct dispatch, not an `implement-loop`-style script.
 
@@ -343,8 +344,10 @@ reflection for how this folds `brainstorm` into the autonomous cascade.
 - **Autonomous behaviour:** `../boss/SKILL.md` § Direction freedom (trigger 4)
   and the Entry-path reflection — how the autonomous swarm-brainstorm decides
   convergent forks and bounces only divergent ones.
-- **Ad-hoc dispatch.** The orchestrator MAY also ad-hoc dispatch
+- **Ad-hoc dispatch.** The orchestrator MAY ad-hoc dispatch
   `../planner/agents/plan-recon.md` during Step 1 when the cycle enters code
-  territory not recently read; ad-hoc, not part of the standard process.
+  territory not recently read. Subject to the coverage condition in
+  `../docs/pipeline.md` § Cycle recon, that dispatch then IS the cycle's one
+  full recon; `specify` and `planner` reuse its report.
 - **Project feature-acceptance criterion:** declared in the project's
   `CLAUDE.md` — applied prospectively by `specify` (its Step 2), not here.