[PIR #1011] Deliver framework files via resolver-aware channels (fresh-install class fix)

[amrmelsayed]

Draft for team feedback. Opened mid-PIR (at the dev-approval gate) to get eyes on the design before it's finalized. The formal review-phase flow (review file, 3-way consult, pr gate) still follows; this PR will be reused, not replaced.

Fixes #1011.

Problem

Post-Spec-618, framework files (protocol docs, role docs, templates, resources) live only in the package skeleton and resolve via the four-tier resolver. But various builder-side consumers referenced them by literal codev/... path (cat/cp, "read this file"), which bypasses the resolver and fails in fresh installs — builders waste turns hunting for files that aren't on disk. #1011 is the class fix.

Approach — three layers

Layer 1 — Delivery (fresh-at-spawn, no committed copy).
buildPromptFromTemplate fills a {{protocol_reference}} placeholder by reading protocol.md fresh through the resolver at spawn, and resolves {{> path}} include directives inside it (for protocol templates). Nothing is committed into the prompts, so nothing can go stale. {{#if protocol_reference}} keeps protocols without a protocol.md (e.g. bugfix in a fresh install) rendering cleanly.

Layer 2 — Cleanup (sweep).
Removed the literal protocol.md pointer from all 9 builder-prompts, fixed the cat codev/protocols/... example in roles/builder.md, dropped the redundant plan-template pointers in spir/aspir plan prompts (those prompts already carry a self-contained ### Plan Structure), and stripped the workflow-reference.md pointer from spir/protocol.md.

Layer 3 — Enforcement.
A scoped convention note in CLAUDE.md / AGENTS.md (don't shell-cat/cp framework files in builder-facing prompts) plus a narrow codev doctor audit (lib/framework-ref-audit.ts) that flags only shell-fetch verbs reading codev/(protocols|roles)/..., warn-not-error, skeleton-only.

Open questions for reviewers

1. Two delivery mechanisms. protocol.md is delivered via a context variable ({{protocol_reference}}, so the existing {{#if}} can conditionally show a "see below" reference and omit it cleanly for protocol-less protocols); templates use a {{> path}} include directive (new, resolved by resolveIncludes, modeled on Handlebars partials). The {{#if}}/{{var}} is existing codev template syntax; {{> }} is new surface. Is the two-mechanism split worth it, or collapse to one (lose the conditional reference, or use a non-Handlebars marker like <!-- include: ... -->)?
2. Doctor scope. The audit deliberately flags only shell-fetch of framework files, not documentation references (the skeleton has ~60 legit codev/... mentions, incl. the documented protocol list in templates). Is warn-not-error / skeleton-only the right default?
3. Convention note. Tightened from a blanket "never reference by path" to a scoped "don't shell-fetch in builder-facing prompts." Right altitude?

Deferred (not in this PR)

• protocols: protocol-doc hygiene (bugfix skeleton-absence + staleness; experiment committed template copy) #1013 — bugfix/protocol.md is absent from the skeleton (and the local copy is partly stale vs porch); and experiment/protocol.md commits a partial copy of its notes template via a relative ref. Both are doc-hygiene, split out to keep this PR to the delivery plumbing.

Scope / tests

• 44 files (+811/−52). Core change: packages/codev/src/agent-farm/commands/spawn-roles.ts + packages/codev/src/lib/framework-ref-audit.ts + packages/codev/src/commands/doctor.ts; the rest is skeleton/codev/ markdown + tests.
• npm run build ✓, full suite ✓ (3271 passed, 13 pre-existing skips). New unit tests cover the placeholder fill, {{> }} include resolution, the doctor audit (positive + negative), and the skeleton sweep; updated the Spec 746 baselines + a bug: ASPIR builder-prompt references SPIR, spawn --task skips porch init, fragile phases check #619 assertion that the sweep invalidated.
• Verified end-to-end against the real skeleton: protocol.md inlines fresh, "Read and internalize" restored, {{> }} expands, zero handlebar residue.