fix(coderabbit): resolve all 12 findings on PR #3152

MAJOR (security/correctness):
- commands/gsd/debug.md: add Write to allowed-tools (session file creation
  requires it — workflow explicitly says 'use Write tool, never heredoc')
- workflows/debug.md: add SLUG sanitization guard to steps 1b+1c (status/
  continue subcommands used raw user input in file paths — path traversal)
- workflows/thread.md: sanitize $ARGUMENTS in RESUME mode before file path
  construction (was bypassing the sanitization guard in CLOSE/STATUS modes)

MINOR (consistency/correctness):
- docs/INVENTORY-MANIFEST.json: remove stale top-level 'workflows' array
  (duplicate of families.workflows introduced in earlier update)
- commands/gsd/resume-work.md: normalize process to 'Execute end-to-end.'
- commands/gsd/settings.md: normalize process to 'Execute end-to-end.'
- commands/gsd/update.md: normalize otherwise branch to 'execute end-to-end.'
- docs/adr/0002: add Status: Accepted + Date header (ADR convention)
- workflows/extract-learnings.md: rename step extract_learnings → extract-learnings
- tests/extract-learnings.test.cjs: tighten step-name assertion to exact name

ARCHITECTURE:
- scripts/command-contract-helpers.cjs: extract CANONICAL_TOOLS, parseFrontmatter,
  executionContextRefs as shared module — single source of truth consumed by
  both lint script and test suite (prevents silent lint/test disagreement)
- scripts/lint-command-contract.cjs: require() helpers instead of duplicating
- tests/command-contract.test.cjs: require() helpers; move readFileSync calls
  inside test() callbacks (registration-time throws surface as named failures)

scripts/strip-prose-atrefs.cjs

@@ -30,11 +30,11 @@ const DRY_RUN      = process.argv.includes('--dry-run');
 const ROOT         = path.join(__dirname, '..');
 const COMMANDS_DIR = path.join(ROOT, 'commands', 'gsd');
 
-const AT_PATH_RE = /@(?:~|\$HOME)\/.+?get-shit-done\/[^\s`\)]+/g;
+const AT_PATH_PATTERN = /@(?:~|\$HOME)\/.+?get-shit-done\/[^\s`\)]+/;
+const mkAtRe = () => new RegExp(AT_PATH_PATTERN.source, 'g');
 
 function transformLine(line) {
-  if (!AT_PATH_RE.test(line)) return line;
-  AT_PATH_RE.lastIndex = 0;
+  if (!AT_PATH_PATTERN.test(line)) return line;
 
   const trimmed = line.trim();
 
@@ -76,8 +76,9 @@ function processFile(filePath) {
     if (/<(process|context)>/.test(t) && !t.includes('execution_context')) inProse = true;
     if (/<\/(process|context)>/.test(t) && !t.includes('execution_context')) inProse = false;
 
-    if (inProse && AT_PATH_RE.test(line)) {
-      AT_PATH_RE.lastIndex = 0;
+    if (inProse && AT_PATH_PATTERN.test(line)) {
+      const re = mkAtRe();
+      re.lastIndex = 0;
       out.push(transformLine(line));
     } else {
       out.push(line);