feat(spec-polish): add /ccmagic:spec-polish and ccm-spec-polish (RV-90)

[devondragon]

Ticket: https://linear.app/blackmagicconsulting/issue/RV-90

/ccmagic:spec-polish <change> reviews an OpenSpec change in rounds before Reeve plans it, then writes the polish record openspec/changes/<change>/.reeve.yml that Reeve reads at planning (Reeve PR linked on the ticket).

How the loop works

• Each round dispatches a fresh read-only opus reviewer with review-prompt.md. It reads the change against the specs and the code and lists every problem it finds. Findings you rejected in earlier rounds are passed to later reviewers so they are not raised again.
• You accept or reject each finding, and the session applies the accepted ones inside the change folder.
• After each round, openspec validate --strict --no-interactive, ccm-propose-check, and reeve openspec render --grade must pass.
• A round is clean when nothing was accepted and no file changed, including fixes for a failing check. Two consecutive clean rounds end the loop. --max-rounds defaults to 6.
• The skill then writes the record, confirms that Reeve's render line reads polished, commits after a final stop, and pushes only to origin/<current branch>. It never merges.

Changes

• bin/ccm-spec-polish (new) has four modes:
  • hash: Reeve's polishFilesHash from git hash-object.
  • write: writes the record.
  • check: reads the record as Reeve does and exits 0 only for polished.
  • preflight: the change-name rule, the folder and its tasks.md, and planned for a change already on the default branch, where an edit is drift for reeve replan.
• skills/spec-polish/SKILL.md and review-prompt.md (new). The write grants are limited to openspec/changes/**.
• tests/run.sh: tests for every mode, including a files-hash vector Reeve computed for the propose fixture, plus the skill's grant and workflow checks. spec-polish is registered as a standalone skill.
• README, help, CHANGELOG, a note in propose/change-format.md, and release 3.23.0.

Verified

• bash tests/run.sh: 431 passed with OpenSpec 1.14.1 on PATH.
• shellcheck -x as CI runs it reports no findings.
• One opus review agent read the diff and found no Critical or High issues. It found one Medium (a round that fixes a check could count as clean) and seven Low issues, all fixed in this branch.

Not built

• The ticket's optional round under a second model family. ccm-external-review reviews diffs or file lists with code-review prompts, and adding a spec-review dimension to it is a separate piece of work.
• The skill has not been run end to end against a real change. That run is AC 1 on the ticket.

Second review pass

These commits follow Reeve's changes from its second review (reeve#169):

• b637c9b: ccm-propose-check reports meta for a .openspec.yaml larger than 64 KB, and ccm-openspec-scope stops with exit 3 on such a base file in archive mode. Reeve's planner now rejects that file, and its gate parks the archive PR as meta-unreadable, so both mirror checks agree with Reeve again.
• f8bc79a: ccm-spec-polish never covers a symlinked kept file. hash lists such files under links, write refuses (exit 3), and check reads the record as malformed. This matches Reeve, which reads a mode-120000 kept file as malformed. The script header now points to ccm-openspec-version for the OpenSpec version, which fixes openspecver_version_in_one_place.
• bash tests/run.sh: 434 passed with OpenSpec 1.14.1 on PATH. shellcheck -x reports no findings.