[WIP] Add multi-agent roadmap discovery plugin

[Copilot]

Thanks for the feedback on #236. I've created this new PR, which merges into #236, to address your comment. I will work on the changes and keep this PR's description up to date as I make progress.

Original PR: #236
Triggering comment (#236 (comment)):

PR Comment Status

Status	Threads	Review Bodies	Issue Comments	Total
Resolved	0	3	3	6
Fixed by DLC	7	0	0	7
Answered by DLC	2	0	0	2
Skipped (user decision)	0	0	0	0
Discussion-Deferred	0	0	0	0
Discussion-Tracked	0	0	0	0
Pending-Human	2	0	1	3
Blocked	0	0	0	0
Dismissed	0	0	0	0
Total	11	3	4	18

Fixed

• feature-discovery.workflow.js:33 — added scope/depth normalization + allowlist validation, returning a structured invalid-args error on bad input (also fixes the duplicate finding at :59).
• feature-discovery.workflow.js:134 — bounded VERDICT_SCHEMA.confidence to 1-10, matching the validator prompt.
• feature-discovery.workflow.js:226 — added a synthesis-failed guard when the synthesizer returns no report.
• feature-discovery.workflow.js:216 — added an empty-validated-results guard before synthesis when no features survive validation.
• plugins/feature-discovery/README.md:4 — linked the Claude Code badge (also fixes the duplicate finding on the same line).

Answered (verified false positives)

• "Illegal top-level return" — node --check passes; this repo has no "type": "module" override, so .js files run under Node's CommonJS wrapper, which permits top-level return. This exact script has also already completed full live Workflow runs successfully in this repo.
• "Missing scripts/hooks/agents/commands directories" — scripts/validate-plugins.mjs:86,130 requires at least one of the four directories (OR, not AND), and three existing plugins (doppler, oasis-dev, temporal) ship with only skills/ and pass CI today.

Needs your input (Pending-Human)

These require a human call and were intentionally left unresolved and unreplied — an attended /dlc:pr-check 236 run will surface them for triage:

1. Prompt gates external MCP/CLI calls with no read-only restriction (feature-discovery.workflow.js:45, @copilot-pull-request-reviewer) — the ideation prompt lets an agent invoke any connected MCP server/CLI to "inspect live usage." Tightening this diverges from the locked "verbatim upstream engine" decision for this PR — your call on whether to harden it here or track separately.
2. Unbounded prompt/context growth from JSON-stringified intermediates (feature-discovery.workflow.js:191, @qodo-code-review; also raised as part of the bundled Qodo issue-comment review) — full inventory/competitor/idea payloads are embedded verbatim into every downstream agent prompt. A real cost/reliability concern at scale, but bounding it is an architecture change to the "kept verbatim" engine — needs your judgment on scope.

Follow-up

Author will address the Pending-Human items above manually, or re-run /dlc:pr-check 236 in attended mode to triage them interactively.

Separately (not blocking, not part of this PR's diff): the empty Claude Code badge link fixed here is a repo-wide copy-paste pattern — 7 of 8 plugin READMEs share the same dead ]() link. Worth a follow-up cleanup PR if useful.