fix(ship): agent-mode pipeline blockers found dogfooding on a real repo

[teragrid]

Nine issues that stopped forge ship --agent-mode from certifying a feature end-to-end on a large Next.js/Supabase repo (found 2026-09-07 driving the pipeline by hand). After these fixes the same feature's pipeline reports ship pipeline ready (all checkpoints validated) — spec/arch/test/breakdown/ship all ✓.

#	Problem	Fix
7	forge clean flagged ~465 git-ignored files (.playwright-mcp/*.log, sibling .claude/worktrees/*) as "unmanaged scratch"; the ship hygiene gate hard-failed and told the user to forge clean --apply, which would delete other tools'/sessions' ignored files.	clean now skips git-ignored paths outside .forge/ by default (still tidies forge's own ignored scratch). --include-ignored restores the old behaviour.
8	self-review-gate / spec-completeness / adr-quality / tdd-gate / security-hygiene / qa-coverage / manual-test-plan / four-stage-testing resolved the spec dir with slugify(description), ignoring the --name/-n override agent-mode always sets → every gate reported "artefact not found / UNVERIFIED" while the files sat under .forge/specs/<name>/.	All use HookContext.SpecName via new ctxSpecSlug(ctx); testingPipelineEvidencePath accepts a resolved slug.
8	Same gates only looked for the canonical filename; agent-mode writes test.md / code-plan.md / etc.	readSpecArtefact() aliases: arch.md↔adr.md, test.md↔tests.md↔test-stubs.md, code-plan.md↔impl-notes.md.
8b	Once gate 8 made the scan actually run, a bare strings.Contains(content,"...") in self-review-gate flagged prose elisions, P1-01 … P1-09 ranges and { ... } code as "hedging".	Removed bare "..."; a per-line check still catches a line that is only dots or a key: ... / = ... stub, skipping fenced code.
8c	tdd-gate only accepted Gherkin or func Test* as a "test scenario".	Also accepts it() / test() / describe() (Jest/Vitest/Jasmine/Mocha); reads test-stubs.md before forge's thin test.md.
6	checkCode reported "N modified file(s)" + status ok by counting every dirty git status line (docs, .forge ledgers, another session's screenshots) — the known "✓ Code with zero code" gap.	countChangedSourceFiles() counts only source extensions, excluding .forge/ docs/ growth/. A plan with no source change now reports warning — implement then rerun + "(N other working-tree change(s) not attributed to this checkpoint)".
5	Test artefacts always written to <root>/tests, invisible to a runner whose roots are src; the reachability check then swept the whole repo and flagged the project's pre-existing tests/e2e/* / tests/staging/* suites as "unreachable".	pickTestsDir() prefers an existing collected dir (src/test, …); allTestArtifactsExist / missingTestArtifacts check both; reachability now runs only against the artefacts forge wrote for this slug.
4	ship:test:integration prompt (and the ship-test template) hard-coded "Jest + supertest"; on a repo without supertest / a single HTTP entrypoint the stub couldn't compile.	Prompts now tell the model to follow the project's own integration-test convention and not import a package the project lacks.
2	forge agent submit --file failed on a path with .. or mixed separators (FORGE-6900 … cannot find the path specified) even when the file existed.	readAnswer filepath.FromSlash + Cleans the path and resolves a relative one against cwd.

Not fixed (noted for follow-up): npm shim resolving a nested forge.exe copy (#1), pending.json needing an explicit UTF-8 read on Windows (#3), -n vs --session desync footgun (#9).

Tests: go test ./internal/... green (76 packages); two TestCheckCode assertions updated to the corrected "a plan is not an implementation" contract.

🤖 Generated with Claude Code