feat(amp): add deterministic native workflows

[oliver-kriska]

Summary

Refresh the canonical Amp integration on current main and make its workflow behavior deterministic where the supported Plugin API allows. The generated target includes all 51 Agent Skills, 40 paired-local workflow wrappers, five native controls, five read-only specialists, bounded parallel analysis, and lifecycle safety controls.

This branch was rebased from the original #132 onto main at 3f0f117; generated artifacts were regenerated from canonical source rather than conflict-merged. The installable artifacts remain owned here and will be projected from the reviewed commit into the separately gated amp-elixir-phoenix distribution PR.

What changes

• Generate 40 workflow palette wrappers and five native controls alongside all 51 Agent Skills.
• Project the canonical Elixir, Ecto, LiveView, security, and testing reviewers into lower-cost child agents restricted to Read and finder.
• Add bounded parallel review/investigation, a persistent classified edit lock, and a bounded wrapper-activated phx-full verification gate.
• Align local wrapper resolution with Amp's supported precedence: machine-local roots first, then .agents/skills and .claude/skills from exposed workspaceRoot through its parents, then the legacy home fallback.
• Skip missing, unreadable, and non-file candidates so invalid higher-precedence entries cannot mask a valid lower source.
• Make the Bun plugin behavior harness a required CI check rather than an optional local skip.
• Compact generated metadata and share the repeated specialist contract in the output so the 95,269-byte plugin remains below Amp's hosted process-argument transport boundary while reconstructing the same enforced instructions at runtime.
• Document native skill: invoke, hosted-native versus paired-full profiles, machine-local versus personal/workspace hosted scope, independent skills/plugin publication, and skills-first rollout ordering.
• Preserve the standalone repository, generated target, gated mutable stable, paired local install, and GitHub/curl compatibility paths.

Explicit Plugin API boundary

Native skill: invoke uses Amp's effective resolver and supports local, built-in, personal hosted, and workspace hosted skills. The current Plugin API does not expose skill resolution/invocation or Amp's original nested invocation directory, so filesystem wrappers cannot correctly inject hosted-only, built-in, plugin-cache, custom-path, or unexposed nested skill bodies.

Consequently:

• hosted-native supports native skill invocation, specialists, parallel commands, and edit lock;
• paired-full supports those features plus all 40 local wrappers;
• only paired phx: full arms the plugin verification gate; native hosted skill: invoke → phx-full follows skill guidance but cannot activate that wrapper hook.

The implementation documents this boundary instead of scanning undocumented Amp caches or claiming unsupported hosted wrapper behavior.

Safety and distribution

Specialists cannot edit, run shell commands, or recursively create agents. Edit-lock paths resolve symlinks and fail closed on malformed, unreadable, or workspace-escaping state. Verification rejects piped, chained, neutralized, pre-edit, unrelated-PID, and nonzero-exit checks.

The generated plugin deliberately retains the direct GitHub/curl fallback. Promotion to the standalone distribution and mutable stable remains separately review-gated; neither is changed by this canonical PR.

Rebase onto 874d2e4 (two Amp plugins)

main landed feat(amp): add native PR watch lifecycle while this branch was
open, which introduced a second Amp plugin on the same generator surface.
Both commits independently defined build_target(), validate_plugin(), and
the same OUTPUT_DIR, with different designs:

	this branch	874d2e4
plugin	elixir-phoenix.ts	phx-watch-pr.ts
produced by	rendered from Python	copied verbatim from canonical source
why	inlines projected agent bodies and skill metadata	real TypeScript with no projected data

Neither style can replace the other, so build_target() now emits both.
validate_plugin() keeps main's signature and meaning; the rendered one became
validate_workflow_plugin() and PLUGIN_RELATIVE_PATH became
WORKFLOW_PLUGIN_RELATIVE_PATH, confining the rename to this branch. Generated
files were regenerated from source, never hand-merged.

The transport budget needed the full branch: after the first commit the rendered
plugin reached 98,745 bytes against its own 96,000 assert (phx-watch-pr joined
PORTABLE_WORKFLOWS, and the shared specialist contract was still inlined five
times). The third commit's compaction lands it at 95,191 bytes, 809 bytes of
headroom.

Verification

Canonical commit: b748795 (rebased onto main at 874d2e4)

• make ci — PASS: 243 tests (including the Bun runtime harness), Claude manifest validation, all generated-target drift/snapshot checks, and full structural eval (51 skills, 26 agents). Skillspector was not installed in the orb, so the Makefile's optional security target reported its documented skip.
• make amp-runtime-smoke — PASS with Amp 0.0.1786436318-g8453bf (2026-08-11): 51 skills and plugin loaded in isolation without model calls.
• Personal hosted plugin transport pilot — PASS: the exact 95,269-byte plugin loaded user-scoped with all 45 commands and both parallel tools; the interactive edit lock blocked shell execution and hosted-only wrappers failed with their documented local-install requirement.
• make amp-target-validate — PASS: 51 skills and plugin, with regenerated golden snapshot.
• Focused resolver/runtime suite — PASS: 31 tests under Bun 1.3.14, including machine-local precedence, parent-directory resolution, invalid-entry fallback, all wrappers, specialists, parallel partial failure, edit-lock escapes, and verification lifecycle cases.
• Ruff, yamllint, Markdown lint, npm audit --audit-level=high, and git diff --check — PASS; npm audit found 0 vulnerabilities.

Review focus

The highest-value review areas are the documented hosted-wrapper boundary, local resolver precedence, Amp lifecycle assumptions, edit-lock enforcement, verification result classification, and generator-to-target parity.

---