fix(skill): make Clarity risk discovery optional, not a required gate.

[alex ngo (ango10)]

Summary

Makes Clarity risk discovery optional in the run-assert-eval skill. Users can seed an eval from their own description, PRD, threat model, or incident report instead of being blocked at a mandatory .clarity-protocol/ gate.

Motivation / linked issue

Resolves #318.

The skill treated .clarity-protocol/ as a hard precondition: with no protocol present it would stop and walk the user through MCP setup rather than proceed. That blocks anyone who already knows the risk they want measured, and anyone who can't run Clarity at all (it needs Python 3.12+ and an MCP-capable IDE). The root README stated the constraint outright. "Risks always come from Clarity the skill won't let you seed an eval from an off-the-cuff description."

Clarity remains the recommended path. It is no longer the only one.

Changes

• Replaced the gate with an explicit risk-source choice in Step 1: 1a Clarity discovery (recommended) or 1b user-supplied risks. Both emit the same candidate-behavior contract, so every downstream step (triage, config generation, running, judging, governance) is risk-source agnostic.
• Added a structured intake for Path B: context, prohibited behavior, the permissible boundary, elicitation variants, and severity: the same fields clarity_intake.py already produces, so no downstream code changes were required.
• Made Clarity write-backs conditional on a protocol actually existing (measure-clarity-failures.md Step 8, govern-and-remeasure.md Step 7), and marked the measurement workflow's Step 1 (Parse) skippable on Path B.
• Mirrored across all four skill surfaces so behavior is identical in every IDE: SKILL.md (canonical), .github/prompts/run-assert-eval.prompt.md, .cursor/rules/assert.mdc, and .github/copilot-instructions.md.
• Corrected the docs that asserted the requirement: root README.md (including splitting onboarding, so ASSERT needs 3.11+ and only Clarity needs 3.12+/MCP), AGENTS.md, the skill README.md, and SETUP-CHECKLIST.md (now marked Optional, with a Path B verification item).

Unchanged by design: the mandatory human triage gate, the .clarity-protocol/ preservation STOP, and the ban on the agent imitating Clarity's interview.

Testing

• Repo-wide wording sweep: enumerated all 29 files mentioning Clarity across all file types, plus multiline greps (a gate word on the line following a Clarity mention) and indirect phrasings ("front door", "only source", "risk-discovery engine").
• Manual: with .clarity-protocol/ absent, ran the skill against a domain with no eval configs and no result suite; confirmed it offers the risk-source choice instead of stopping to demand MCP setup.

Checklist

• Tests pass locally (pytest and/or viewer checks as applicable).
• Docs updated if behavior or public API changed.
• No secrets, credentials, or customer data committed.
• No breaking change, or a CHANGELOG.md entry is included.

[alex ngo (ango10)]