feat: debug skill dispatch and session manager sub-orchestrator (#2154)

* feat(2148): add specialist_hint to ROOT CAUSE FOUND and skill dispatch to /gsd-debug

- Add specialist_hint field to ROOT CAUSE FOUND return format in gsd-debugger structured_returns section
- Add derivation guidance in return_diagnosis step (file extensions → hint mapping)
- Add Step 4.5 specialist skill dispatch block to debug.md with security-hardened DATA_START/DATA_END prompt
- Map specialist_hint values to skills: typescript-expert, swift-concurrency, python-expert-best-practices-code-review, ios-debugger-agent, engineering:debug
- Session manager now handles specialist dispatch internally; debug.md documents delegation intent

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* feat(2151): add gsd-debug-session-manager agent and refactor debug command as thin bootstrap

- Create agents/gsd-debug-session-manager.md: handles full checkpoint/continuation loop in isolated context
- Agent spawns gsd-debugger, handles ROOT CAUSE FOUND/TDD CHECKPOINT/DEBUG COMPLETE/CHECKPOINT REACHED/INVESTIGATION INCONCLUSIVE returns
- Specialist dispatch via AskUserQuestion before fix options; user responses wrapped in DATA_START/DATA_END
- Returns compact ≤2K DEBUG SESSION COMPLETE summary to keep main context lean
- Refactor commands/gsd/debug.md: Steps 3-5 replaced with thin bootstrap that spawns session manager
- Update available_agent_types to include gsd-debug-session-manager
- Continue subcommand also delegates to session manager

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* test(2148,2151): add tests for skill dispatch and session manager

- Add 8 new tests in debug-session-management.test.cjs covering specialist_hint field,
  skill dispatch mapping in debug.md, DATA_START/DATA_END security boundaries,
  session manager tools, compact summary format, anti-heredoc rule, and delegation check
- Update copilot-install.test.cjs expected agent list to include gsd-debug-session-manager

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/debug-session-management.test.cjs

@@ -118,3 +118,52 @@ describe('debug session management implementation', () => {
     assert.ok(content.includes('DATA_START'), 'gsd-debugger.md must contain DATA_START security reference');
   });
 });
+
+// Tests for #2148 and #2151
+describe('debug skill dispatch and sub-orchestrator (#2148, #2151)', () => {
+  test('gsd-debugger ROOT CAUSE FOUND format includes specialist_hint field', () => {
+    const content = fs.readFileSync(path.join(process.cwd(), 'agents', 'gsd-debugger.md'), 'utf8');
+    assert.ok(content.includes('specialist_hint'), 'gsd-debugger missing specialist_hint in ROOT CAUSE FOUND');
+    assert.ok(content.includes('swift_concurrency'), 'gsd-debugger missing specialist_hint derivation guidance');
+  });
+
+  test('debug.md orchestrator has specialist skill dispatch step', () => {
+    const content = fs.readFileSync(path.join(process.cwd(), 'commands', 'gsd', 'debug.md'), 'utf8');
+    assert.ok(content.includes('specialist_hint'), 'debug.md missing specialist dispatch logic');
+    assert.ok(content.includes('typescript-expert'), 'debug.md missing skill dispatch mapping');
+  });
+
+  test('debug.md specialist dispatch prompt uses DATA_START/DATA_END boundaries', () => {
+    const content = fs.readFileSync(path.join(process.cwd(), 'commands', 'gsd', 'debug.md'), 'utf8');
+    assert.ok(content.includes('DATA_START') && content.includes('DATA_END'),
+      'debug.md specialist dispatch prompt missing security boundaries');
+  });
+
+  test('gsd-debug-session-manager agent exists with correct tools', () => {
+    const content = fs.readFileSync(path.join(process.cwd(), 'agents', 'gsd-debug-session-manager.md'), 'utf8');
+    assert.ok(content.includes('Task'), 'gsd-debug-session-manager missing Task tool');
+    assert.ok(content.includes('AskUserQuestion'), 'gsd-debug-session-manager missing AskUserQuestion tool');
+  });
+
+  test('gsd-debug-session-manager uses DATA_START/DATA_END for checkpoint responses', () => {
+    const content = fs.readFileSync(path.join(process.cwd(), 'agents', 'gsd-debug-session-manager.md'), 'utf8');
+    assert.ok(content.includes('DATA_START') && content.includes('DATA_END'),
+      'gsd-debug-session-manager missing security boundaries on checkpoint responses');
+  });
+
+  test('gsd-debug-session-manager has compact summary output format', () => {
+    const content = fs.readFileSync(path.join(process.cwd(), 'agents', 'gsd-debug-session-manager.md'), 'utf8');
+    assert.ok(content.includes('DEBUG SESSION COMPLETE'), 'session manager missing compact summary format');
+  });
+
+  test('gsd-debug-session-manager includes anti-heredoc rule', () => {
+    const content = fs.readFileSync(path.join(process.cwd(), 'agents', 'gsd-debug-session-manager.md'), 'utf8');
+    assert.ok(content.includes('heredoc'), 'session manager missing anti-heredoc rule');
+  });
+
+  test('debug.md delegates to gsd-debug-session-manager', () => {
+    const content = fs.readFileSync(path.join(process.cwd(), 'commands', 'gsd', 'debug.md'), 'utf8');
+    assert.ok(content.includes('gsd-debug-session-manager'),
+      'debug.md does not delegate to session manager');
+  });
+});