enhance(#3085): add Grep to allowed-tools for 21 skills (#4397)

* enhance(#3085): add Grep to allowed-tools for 21 skills

29 of 71 skills omit Grep from allowed-tools, forcing Bash grep for
structured search instead of the dedicated tool. Adds Grep to the
21-skill subset confirmed safe in prior review (excludes the 6
gsd-ns-* dispatchers, gsd-help, and gsd-surface, which have no
plausible structured-search need).

Hand-edits commands/gsd/*.md only; skills/*/SKILL.md is regenerated
via `npm run gen:plugin-skills` from that source. Updates the one
hardcoded copilot-install test assertion affected by gsd-health's
new tool order.

* chore(#3085): backfill changeset PR number

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* test(#2618): assert the Needs clause on the structured field, not the path-length-dependent bullet

The bullet embeds the todo file's ABSOLUTE path, so its total length
varies by runner tmpdir: on macOS CI, /private/var/folders/… plus the
test harness's gsd-test-run-* wrapper pushed the full bullet to 244
chars — past renderPendingTodoBullet's intended 240-char cap, whose
documented first degradation step drops the Needs clause. The product
behavior is correct (#2618 design); the assertion was runner-dependent.
The extraction is now pinned on json.todos[0].needs; the rendered-bullet
shape stays covered by the path-independent title assertion and the
renderer's own unit rows.

Found blocking #4186's CI on the macOS shard (test landed 30 minutes
earlier in b7406b293f / PR #4384).

---------

Co-authored-by: sim <sim@local>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

tests/copilot-install.test.cjs

@@ -743,7 +743,7 @@ describe('installRuntimeArtifacts (copilot integration)', () => {
     const skillContent = fs.readFileSync(path.join(skillsDir, 'gsd-health', 'SKILL.md'), 'utf8');
     // Frontmatter format checks
     assert.ok(skillContent.startsWith('---\nname: gsd-health\n'), 'starts with name: gsd-health');
-    assert.ok(skillContent.includes('allowed-tools: Read, Bash, Write, AskUserQuestion'),
+    assert.ok(skillContent.includes('allowed-tools: Read, Bash, Grep, Write, AskUserQuestion'),
       'allowed-tools is comma-separated');
     assert.ok(!skillContent.includes('allowed-tools:\n  -'), 'NOT YAML multiline format');
     // CONV-06/07 applied

tests/state-todos-render.test.cjs

@@ -319,9 +319,19 @@ test('cmdInitTodos: real todo file produces a rendered bullet via the CLI', (t)
 
   const json = runQueryInitTodos(dir);
   assert.equal(json.pending_read_ok, true);
-  assert.equal(json.todo_count, 1);
   assert.match(json.pending_todos_markdown, /Fix retry logic/);
-  assert.match(json.pending_todos_markdown, /Needs Add a max-attempts cap\.$/m);
+  // The Needs clause is asserted on the STRUCTURED field, not the rendered
+  // bullet: the bullet embeds the todo file's ABSOLUTE path, so its total
+  // length varies by runner tmpdir (macOS CI's /private/var/folders/… plus
+  // the test harness's gsd-test-run-* wrapper pushed the full bullet past
+  // renderPendingTodoBullet's intended 240-char cap, whose documented first
+  // degradation step is to drop the Needs clause — a correct product
+  // behavior this test must not depend on the runner's path length for).
+  assert.equal(json.todo_count, 1);
+  assert.ok(Array.isArray(json.todos) && json.todos.length === 1, 'todos array must carry the one todo');
+  // (the raw field keeps the trailing period; only the rendered bullet
+  // strips it — renderPendingTodoBullet's own unit rows pin that.)
+  assert.equal(json.todos[0].needs, 'Add a max-attempts cap.');
 });
 
 test('cmdInitTodos: needs clause survives a deterministically long base path (#4384 macOS shape)', (t) => {