feat: batch execute — one shared worktree, commit per plan, checkpoint gates

[erkamdemirci]

Implements #25.

Problem

execute handles exactly one plan per invocation, and each invocation provisions its own worktree. Executing a six-plan backlog means six dispatches babysat by the operator and six toolchain warm-ups, with the full done-criteria suite re-run per plan — even though the skill already writes plans/README.md as a dependency-ordered queue. Everything needed to run the backlog end-to-end is already on disk; the invocation surface just can't express it.

Change

execute all / execute <range> (e.g. execute 001-004) runs the backlog through one shared batch worktree instead of a worktree per plan:

• Setup, once — git worktree add <path> -b advisor/batch-<slug> from the user's HEAD, provision it, then run the repo's full gate as a baseline. Red baseline → stop: pre-existing failures poison every subsequent review, and "restore the baseline" is the real plan Reword security audit guidance for defensive remediation #1.
• Dispatch, per plan — executors run serially in plans/README.md order (dependencies enforced), one commit per plan, commit SHA in the report. Plans with pairwise-disjoint Scope sections may still fan out to parallel per-plan worktrees; any overlap forces serial.
• Layered verification — so the expensive gate doesn't run twice per plan. Per plan: scope compliance, the plan's scoped done criteria (cheap by construction), full-diff read, test audit — as today. At checkpoints: the repo's full gate every 3–5 approved plans, after any HIGH-risk plan, and always at batch end. On failure, bisect the per-plan commits since the last green checkpoint — that's what commit-per-plan is for.
• Rollback — a BLOCK verdict resets the batch worktree to the last good commit (untracked-leftover cleanup scoped to the plan's in-scope paths; never git clean -fd worktree-wide) and continues with the next plan that doesn't depend on the blocked one. A dead executor (stale IN PROGRESS, dirty worktree) gets the same treatment before the next dispatch.
• plan-template — Done criteria split into a Scoped layer (run on every execution) and a Full gate layer (owned by the dispatcher at checkpoints), each sized to the plan's blast radius. The quality-bar checklist gains a matching check.
• Hard Rule 2's worktree carve-out now names the batch-worktree maintenance it implies (git worktree add, branch creation, reset-to-last-good) — still confined to the disposable worktree.

What doesn't change

Every existing guarantee, verbatim: the advisor never edits code; executors edit only inside a disposable worktree; the user's checkout is never touched; merging stays the user's decision. A lone execute <plan> behaves as before (its "checkpoint" is simply its own end). This changes worktree count, not the isolation model.

Composes with #24 (warm provisioning) but doesn't depend on it — batch mode already amortizes provisioning to once per batch; #24 makes that once cheap too.

🤖 Generated with Claude Code