fix(#2237): fail loud on ambiguous bare-number phase directory collision (#2262)

* fix(#2237): fail loud on ambiguous bare-number phase directory collision

When two unrelated projects share a .planning/phases/ tree, a bare phase
number silently resolved to the first 0N-* directory found — risking
cross-project file writes. The fix detects multiple matches for the same
phase number and surfaces an ambiguous_matches result instead of silently
taking the first.

Changes:
- src/phase-locator.cts: searchPhaseInDir uses filter() + ambiguity check
- src/phase.cts: cmdFindPhase same pattern
- src/init.cts: cmdInitPhaseOp surfaces ambiguous_matches in the result
- tests/phase-locator.test.cjs: 3 regression tests

* docs: backfill changeset PR number (#2262)

* merge: keep up to date with next

* fix: regenerate stale capability-registry after next merge

src/phase.cts

@@ -416,8 +416,20 @@ function cmdFindPhase(cwd: string, phase: string, raw: boolean): void {
         .map((e) => e.name)
         .sort((a, b) => comparePhaseNum(a, b));
 
-      const match = dirs.find((d) => phaseTokenMatches(d, normalized));
-      if (!match) continue;
+      // #2237: fail loud when multiple directories match the same bare phase
+      // number — prevents cross-project file writes when unrelated projects
+      // share a .planning/phases/ tree.
+      const matches = dirs.filter((d) => phaseTokenMatches(d, normalized));
+      if (matches.length === 0) continue;
+      if (matches.length > 1) {
+        output({
+          ...notFound,
+          ambiguous_matches: matches,
+          warning: `Phase ${normalized} is ambiguous: ${matches.length} directories match (${matches.map(m => `"${m}"`).join(', ')}). Set a distinct project_code in .planning/config.json to scope resolution.`,
+        }, raw, '');
+        return;
+      }
+      const match = matches[0];
 
       const dirMatch =
         match.match(