feat: sensei scoring parity — WHEN: triggers, spec-security, Invalid level, advisory checks 16-18 (#79)

* feat: sensei scoring parity — WHEN: triggers, spec-security, Invalid level, advisory checks 16-18, context-dependent anti-triggers

Implements seven features to align waza scoring with spboyer/sensei:

- #72: Add 'WHEN:' trigger pattern recognition (cross-model optimized)
- #73: Add spec-security checker (flags XML angle brackets and reserved prefixes)
- #74: Add Invalid adherence level for descriptions >1024 chars (hard-fail)
- #75: Add cross-model density checker (advisory 16: word count >60, action verb check)
- #76: Add body structure quality checker (advisory 17: examples, code blocks, error handling)
- #77: Add progressive disclosure checker (advisory 18: flags >500 line bodies, >50 line code blocks)
- #78: Add context-dependent anti-trigger risk (Low: 1-5 skills, Moderate: 6-14, High: 15+)

All changes include comprehensive test coverage.

Closes #72, closes #73, closes #74, closes #75, closes #76, closes #77, closes #78

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: address PR #79 review feedback — punctuation stripping, fence parsing, slice traversal, WHEN: count, body field, summary format

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: address PR #79 review feedback — section-bounded counting, severity scaling, security checker nil guard, body line off-by-one, error pattern narrowing

- countPhrasesAfterPattern now stops at all trigger headers (USE FOR:,
  WHEN:, TRIGGERS:, NOT FOR:) to prevent double-counting across sections
- Anti-trigger risk severity scales with context: High→error, Moderate→warning
- SpecSecurityChecker checks reserved name prefixes even when FrontmatterRaw
  is nil (programmatically constructed skills)
- ProgressiveDisclosureChecker trims trailing newline before line count to
  avoid off-by-one at the 500-line boundary
- BodyStructureChecker error handling patterns narrowed from broad "error"
  substring to heading-aware patterns ("## error", "error handling",
  "## troubleshooting") to reduce false positives
- Updated display and loop golden strings for new spec-security and
  advisory 16-18 checkers
- All 40 test packages pass

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: hoist regex to package level, pre-compute ToUpper, fix test label

- Move numberedStepsPattern regex to package-level var (was recompiled per Check() call)
- Pre-compute strings.ToUpper(after) in countPhrasesAfterPattern to avoid
  redundant uppercasing on each loop iteration
- Fix boundary test name: 48 lines, not 50

Addresses wbreza review feedback on PR #79.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* refactor: Rename actionVerbs to commonLeadWords in advisory checks

* fix: address review feedback and golden string mismatches on PR #79

- Update golden strings: 'no action verbs' → 'no common lead words'
- Clarify spec-security summary when FrontmatterRaw is nil
- Add TODO for plumbing SkillCount into production callers

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: spboyer

cmd/waza/dev/display_test.go

@@ -38,6 +38,7 @@ Issues:
   ✅ spec-name: Name follows spec naming rules
   ✅ spec-dir-match: Cannot validate (missing path or name)
   ✅ spec-description: Description is valid
+  ✅ spec-security: No security risks detected in frontmatter
   ✅ spec-compatibility: No compatibility field (optional)
   ⚠️ spec-license: No license field found
      📎 Best practice: include a license field (e.g., MIT, Apache-2.0)
@@ -48,8 +49,11 @@ Issues:
   ✅ module-count: Found 0 reference module(s)
   ✅ complexity: Complexity: compact (14 tokens, 0 modules)
   ✅ negative-delta-risk: No negative delta risk patterns detected
-  ⚠️ procedural-content: Description lacks procedural language (no action verbs or procedure keywords found)
+  ⚠️ procedural-content: Description lacks procedural language (no common lead words or procedure keywords found)
   ✅ over-specificity: No over-specificity patterns detected
+  ✅ cross-model-density: Advisory 16: first sentence doesn't lead with action verb (reduces clarity)
+  ⚠️ body-structure: Advisory 17: body structure quality — body lacks actionable instructions (no code blocks, numbered steps, or commands); no examples section found; no error handling or troubleshooting section found
+  ✅ progressive-disclosure: Content structure supports progressive disclosure
 `
 	require.Equal(t, want, buf.String())
 }
@@ -79,6 +83,7 @@ Anti-triggers: 1
   ✅ spec-name: Name follows spec naming rules
   ✅ spec-dir-match: Cannot validate (missing path or name)
   ✅ spec-description: Description is valid
+  ✅ spec-security: No security risks detected in frontmatter
   ✅ spec-compatibility: No compatibility field (optional)
   ⚠️ spec-license: No license field found
      📎 Best practice: include a license field (e.g., MIT, Apache-2.0)
@@ -96,6 +101,9 @@ MCP Integration: 1/4
   ✅ negative-delta-risk: No negative delta risk patterns detected
   ✅ procedural-content: Description contains procedural language
   ✅ over-specificity: No over-specificity patterns detected
+  ✅ cross-model-density: Advisory 16: first sentence doesn't lead with action verb (reduces clarity)
+  ⚠️ body-structure: Advisory 17: body structure quality — body lacks actionable instructions (no code blocks, numbered steps, or commands); no examples section found; no error handling or troubleshooting section found
+  ✅ progressive-disclosure: Content structure supports progressive disclosure
 `
 	require.Equal(t, want, buf.String())
 }
@@ -123,6 +131,7 @@ Anti-triggers: 1
   ✅ spec-name: Name follows spec naming rules
   ✅ spec-dir-match: Cannot validate (missing path or name)
   ✅ spec-description: Description is valid
+  ✅ spec-security: No security risks detected in frontmatter
   ✅ spec-compatibility: No compatibility field (optional)
   ⚠️ spec-license: No license field found
      📎 Best practice: include a license field (e.g., MIT, Apache-2.0)
@@ -135,6 +144,9 @@ Anti-triggers: 1
   ✅ negative-delta-risk: No negative delta risk patterns detected
   ✅ procedural-content: Description contains procedural language
   ✅ over-specificity: No over-specificity patterns detected
+  🌟 cross-model-density: Description density is optimal for cross-model use
+  ⚠️ body-structure: Advisory 17: body structure quality — body lacks actionable instructions (no code blocks, numbered steps, or commands); no examples section found; no error handling or troubleshooting section found
+  ✅ progressive-disclosure: Content structure supports progressive disclosure
 `
 	require.Equal(t, want, buf.String())
 }

cmd/waza/dev/loop_test.go

@@ -109,6 +109,7 @@ Anti-triggers: 0
   ✅ spec-name: Name follows spec naming rules
   ✅ spec-dir-match: Directory name matches skill name
   ✅ spec-description: Description is valid
+  ✅ spec-security: No security risks detected in frontmatter
   ✅ spec-compatibility: No compatibility field (optional)
   ⚠️ spec-license: No license field found
      📎 Best practice: include a license field (e.g., MIT, Apache-2.0)
@@ -121,6 +122,9 @@ Anti-triggers: 0
   ✅ negative-delta-risk: No negative delta risk patterns detected
   ✅ procedural-content: Description contains procedural language
   ✅ over-specificity: No over-specificity patterns detected
+  🌟 cross-model-density: Description density is optimal for cross-model use
+  ⚠️ body-structure: Advisory 17: body structure quality — body lacks actionable instructions (no code blocks, numbered steps, or commands); no examples section found; no error handling or troubleshooting section found
+  ✅ progressive-disclosure: Content structure supports progressive disclosure
 `
 	require.Equal(t, expected, buf.String())
 }
@@ -208,6 +212,7 @@ Anti-triggers: 1
   ✅ spec-name: Name follows spec naming rules
   ✅ spec-dir-match: Directory name matches skill name
   ✅ spec-description: Description is valid
+  ✅ spec-security: No security risks detected in frontmatter
   ✅ spec-compatibility: No compatibility field (optional)
   ⚠️ spec-license: No license field found
      📎 Best practice: include a license field (e.g., MIT, Apache-2.0)
@@ -225,6 +230,9 @@ MCP Integration: 1/4
   ✅ negative-delta-risk: No negative delta risk patterns detected
   ✅ procedural-content: Description contains procedural language
   ✅ over-specificity: No over-specificity patterns detected
+  ✅ cross-model-density: Advisory 16: first sentence doesn't lead with action verb (reduces clarity)
+  ⚠️ body-structure: Advisory 17: body structure quality — body lacks actionable instructions (no code blocks, numbered steps, or commands); no examples section found; no error handling or troubleshooting section found
+  ✅ progressive-disclosure: Content structure supports progressive disclosure
 
 ✅ Target adherence level High reached!
 `
@@ -278,6 +286,7 @@ Issues:
   ✅ spec-name: Name follows spec naming rules
   ✅ spec-dir-match: Directory name matches skill name
   ✅ spec-description: Description is valid
+  ✅ spec-security: No security risks detected in frontmatter
   ✅ spec-compatibility: No compatibility field (optional)
   ⚠️ spec-license: No license field found
      📎 Best practice: include a license field (e.g., MIT, Apache-2.0)
@@ -288,8 +297,11 @@ Issues:
   ✅ module-count: Found 0 reference module(s)
   ✅ complexity: Complexity: compact (15 tokens, 0 modules)
   ✅ negative-delta-risk: No negative delta risk patterns detected
-  ⚠️ procedural-content: Description lacks procedural language (no action verbs or procedure keywords found)
+  ⚠️ procedural-content: Description lacks procedural language (no common lead words or procedure keywords found)
   ✅ over-specificity: No over-specificity patterns detected
+  ✅ cross-model-density: Advisory 16: first sentence doesn't lead with action verb (reduces clarity)
+  ⚠️ body-structure: Advisory 17: body structure quality — body lacks actionable instructions (no code blocks, numbered steps, or commands); no examples section found; no error handling or troubleshooting section found
+  ✅ progressive-disclosure: Content structure supports progressive disclosure
 
 📝 Suggested improvement (description-length):
 ────────────────────────────────────────
@@ -385,6 +397,7 @@ Issues:
   ✅ spec-name: Name follows spec naming rules
   ✅ spec-dir-match: Directory name matches skill name
   ✅ spec-description: Description is valid
+  ✅ spec-security: No security risks detected in frontmatter
   ✅ spec-compatibility: No compatibility field (optional)
   ⚠️ spec-license: No license field found
      📎 Best practice: include a license field (e.g., MIT, Apache-2.0)
@@ -395,8 +408,11 @@ Issues:
   ✅ module-count: Found 0 reference module(s)
   ✅ complexity: Complexity: compact (31 tokens, 0 modules)
   ✅ negative-delta-risk: No negative delta risk patterns detected
-  ⚠️ procedural-content: Description lacks procedural language (no action verbs or procedure keywords found)
+  ⚠️ procedural-content: Description lacks procedural language (no common lead words or procedure keywords found)
   ✅ over-specificity: No over-specificity patterns detected
+  ✅ cross-model-density: Advisory 16: first sentence doesn't lead with action verb (reduces clarity)
+  ⚠️ body-structure: Advisory 17: body structure quality — body lacks actionable instructions (no code blocks, numbered steps, or commands); no examples section found; no error handling or troubleshooting section found
+  ✅ progressive-disclosure: Content structure supports progressive disclosure
 
 📝 Suggested improvement (description-length):
 ────────────────────────────────────────
@@ -420,6 +436,7 @@ Anti-triggers: 0
   ✅ spec-name: Name follows spec naming rules
   ✅ spec-dir-match: Directory name matches skill name
   ✅ spec-description: Description is valid
+  ✅ spec-security: No security risks detected in frontmatter
   ✅ spec-compatibility: No compatibility field (optional)
   ⚠️ spec-license: No license field found
      📎 Best practice: include a license field (e.g., MIT, Apache-2.0)
@@ -432,6 +449,9 @@ Anti-triggers: 0
   ✅ negative-delta-risk: No negative delta risk patterns detected
   ✅ procedural-content: Description contains procedural language
   ✅ over-specificity: No over-specificity patterns detected
+  ✅ cross-model-density: Advisory 16: first sentence doesn't lead with action verb (reduces clarity)
+  ⚠️ body-structure: Advisory 17: body structure quality — body lacks actionable instructions (no code blocks, numbered steps, or commands); no examples section found; no error handling or troubleshooting section found
+  ✅ progressive-disclosure: Content structure supports progressive disclosure
 
 📝 Suggested improvement (triggers):
 ────────────────────────────────────────
@@ -455,6 +475,7 @@ Anti-triggers: 0
   ✅ spec-name: Name follows spec naming rules
   ✅ spec-dir-match: Directory name matches skill name
   ✅ spec-description: Description is valid
+  ✅ spec-security: No security risks detected in frontmatter
   ✅ spec-compatibility: No compatibility field (optional)
   ⚠️ spec-license: No license field found
      📎 Best practice: include a license field (e.g., MIT, Apache-2.0)
@@ -467,6 +488,9 @@ Anti-triggers: 0
   ✅ negative-delta-risk: No negative delta risk patterns detected
   ✅ procedural-content: Description contains procedural language
   ✅ over-specificity: No over-specificity patterns detected
+  ✅ cross-model-density: Advisory 16: first sentence doesn't lead with action verb (reduces clarity)
+  ⚠️ body-structure: Advisory 17: body structure quality — body lacks actionable instructions (no code blocks, numbered steps, or commands); no examples section found; no error handling or troubleshooting section found
+  ✅ progressive-disclosure: Content structure supports progressive disclosure
 
 📝 Suggested improvement (anti-triggers):
 ────────────────────────────────────────
@@ -490,6 +514,7 @@ Anti-triggers: 2
   ✅ spec-name: Name follows spec naming rules
   ✅ spec-dir-match: Directory name matches skill name
   ✅ spec-description: Description is valid
+  ✅ spec-security: No security risks detected in frontmatter
   ✅ spec-compatibility: No compatibility field (optional)
   ⚠️ spec-license: No license field found
      📎 Best practice: include a license field (e.g., MIT, Apache-2.0)
@@ -502,6 +527,9 @@ Anti-triggers: 2
   ✅ negative-delta-risk: No negative delta risk patterns detected
   ✅ procedural-content: Description contains procedural language
   ✅ over-specificity: No over-specificity patterns detected
+  ✅ cross-model-density: Advisory 16: first sentence doesn't lead with action verb (reduces clarity)
+  ⚠️ body-structure: Advisory 17: body structure quality — body lacks actionable instructions (no code blocks, numbered steps, or commands); no examples section found; no error handling or troubleshooting section found
+  ✅ progressive-disclosure: Content structure supports progressive disclosure
 
 📝 Suggested improvement (routing-clarity):
 ────────────────────────────────────────
@@ -584,6 +612,7 @@ Issues:
   ✅ spec-name: Name follows spec naming rules
   ✅ spec-dir-match: Directory name matches skill name
   ✅ spec-description: Description is valid
+  ✅ spec-security: No security risks detected in frontmatter
   ✅ spec-compatibility: No compatibility field (optional)
   ⚠️ spec-license: No license field found
      📎 Best practice: include a license field (e.g., MIT, Apache-2.0)
@@ -594,8 +623,11 @@ Issues:
   ✅ module-count: Found 0 reference module(s)
   ✅ complexity: Complexity: compact (17 tokens, 0 modules)
   ✅ negative-delta-risk: No negative delta risk patterns detected
-  ⚠️ procedural-content: Description lacks procedural language (no action verbs or procedure keywords found)
+  ⚠️ procedural-content: Description lacks procedural language (no common lead words or procedure keywords found)
   ✅ over-specificity: No over-specificity patterns detected
+  ✅ cross-model-density: Advisory 16: first sentence doesn't lead with action verb (reduces clarity)
+  ⚠️ body-structure: Advisory 17: body structure quality — body lacks actionable instructions (no code blocks, numbered steps, or commands); no examples section found; no error handling or troubleshooting section found
+  ✅ progressive-disclosure: Content structure supports progressive disclosure
 
 📝 Suggested improvement (description-length):
 ────────────────────────────────────────