fix(coderabbit): resolve all 12 findings on PR #3152

MAJOR (security/correctness):
- commands/gsd/debug.md: add Write to allowed-tools (session file creation
  requires it — workflow explicitly says 'use Write tool, never heredoc')
- workflows/debug.md: add SLUG sanitization guard to steps 1b+1c (status/
  continue subcommands used raw user input in file paths — path traversal)
- workflows/thread.md: sanitize $ARGUMENTS in RESUME mode before file path
  construction (was bypassing the sanitization guard in CLOSE/STATUS modes)

MINOR (consistency/correctness):
- docs/INVENTORY-MANIFEST.json: remove stale top-level 'workflows' array
  (duplicate of families.workflows introduced in earlier update)
- commands/gsd/resume-work.md: normalize process to 'Execute end-to-end.'
- commands/gsd/settings.md: normalize process to 'Execute end-to-end.'
- commands/gsd/update.md: normalize otherwise branch to 'execute end-to-end.'
- docs/adr/0002: add Status: Accepted + Date header (ADR convention)
- workflows/extract-learnings.md: rename step extract_learnings → extract-learnings
- tests/extract-learnings.test.cjs: tighten step-name assertion to exact name

ARCHITECTURE:
- scripts/command-contract-helpers.cjs: extract CANONICAL_TOOLS, parseFrontmatter,
  executionContextRefs as shared module — single source of truth consumed by
  both lint script and test suite (prevents silent lint/test disagreement)
- scripts/lint-command-contract.cjs: require() helpers instead of duplicating
- tests/command-contract.test.cjs: require() helpers; move readFileSync calls
  inside test() callbacks (registration-time throws surface as named failures)

docs/INVENTORY-MANIFEST.json

@@ -304,94 +304,5 @@
       "gsd-validate-commit.sh",
       "gsd-workflow-guard.js"
     ]
-  },
-  "workflows": [
-    "add-backlog.md",
-    "add-phase.md",
-    "add-tests.md",
-    "add-todo.md",
-    "ai-integration-phase.md",
-    "analyze-dependencies.md",
-    "audit-fix.md",
-    "audit-milestone.md",
-    "audit-uat.md",
-    "autonomous.md",
-    "check-todos.md",
-    "cleanup.md",
-    "code-review-fix.md",
-    "code-review.md",
-    "complete-milestone.md",
-    "debug.md",
-    "diagnose-issues.md",
-    "discovery-phase.md",
-    "discuss-phase-assumptions.md",
-    "discuss-phase-power.md",
-    "discuss-phase.md",
-    "do.md",
-    "docs-update.md",
-    "edit-phase.md",
-    "eval-review.md",
-    "execute-phase.md",
-    "execute-plan.md",
-    "explore.md",
-    "extract-learnings.md",
-    "fast.md",
-    "forensics.md",
-    "graduation.md",
-    "health.md",
-    "help.md",
-    "import.md",
-    "inbox.md",
-    "ingest-docs.md",
-    "insert-phase.md",
-    "list-phase-assumptions.md",
-    "list-workspaces.md",
-    "manager.md",
-    "map-codebase.md",
-    "milestone-summary.md",
-    "new-milestone.md",
-    "new-project.md",
-    "new-workspace.md",
-    "next.md",
-    "node-repair.md",
-    "note.md",
-    "pause-work.md",
-    "plan-milestone-gaps.md",
-    "plan-phase.md",
-    "plan-review-convergence.md",
-    "plant-seed.md",
-    "pr-branch.md",
-    "profile-user.md",
-    "progress.md",
-    "quick.md",
-    "reapply-patches.md",
-    "remove-phase.md",
-    "remove-workspace.md",
-    "resume-project.md",
-    "review.md",
-    "scan.md",
-    "secure-phase.md",
-    "session-report.md",
-    "settings-advanced.md",
-    "settings-integrations.md",
-    "settings.md",
-    "ship.md",
-    "sketch-wrap-up.md",
-    "sketch.md",
-    "spec-phase.md",
-    "spike-wrap-up.md",
-    "spike.md",
-    "stats.md",
-    "sync-skills.md",
-    "thread.md",
-    "transition.md",
-    "ui-phase.md",
-    "ui-review.md",
-    "ultraplan-phase.md",
-    "undo.md",
-    "update.md",
-    "validate-phase.md",
-    "verify-phase.md",
-    "verify-work.md"
-  ]
+  }
 }

docs/adr/0002-command-contract-validation-module.md

@@ -1,5 +1,8 @@
 # Command Contract Validation Module
 
+- **Status:** Accepted
+- **Date:** 2026-05-05
+
 We decided to centralize the `commands/gsd/*.md` file contract into a single validation seam enforced at two layers: a fast lint script (`scripts/lint-command-contract.cjs`) that runs as a pre-test CI step, and a behavioral regression test (`tests/command-contract.test.cjs`) that validates the full contract against the live filesystem.
 
 ## Decision