Add sssf skill, installable via the skills CLI

Port the sssf skill from ~/.agents/skills/sssf into this repo so it can be
distributed and installed with the skills CLI (skills add INDigitalStudio/skills
--skill sssf).

- Copy the skill (SKILL.md, cookbooks, references, scripts, templates, and the
  visualizer app source) into sssf/.
- Gitignore build/runtime artifacts: the visualizer's node_modules/ and dist/,
  Python bytecode, and the machine-specific repos.json.
- Make the skill location-independent: install.py now stamps the skill's real
  path into the stamped justfile's skill_dir (replacing the hardcoded
  ~/.agents/skills/sssf), so 'just obs' finds the visualizer wherever the CLI
  installed the skill.
- Update cookbooks to use <skill>/scripts/... instead of the hardcoded path,
  and document the skills CLI install command.
- Update the repo README with install instructions.

sssf/templates/sssf.config.yaml

@@ -0,0 +1,143 @@
+# sssf.config.yaml — the factory's agent roster. One agent, one prompt, one purpose.
+# v1 runs the Pi or OMP coding agent; coding_agent: claude_code arrives in v2.
+defaults:
+ coding_agent: pi
+ model: google/gemini-3.6-flash # provider/id — a bare pattern is ambiguous across providers
+ thinking: medium # off | minimal | low | medium | high | xhigh | max
+ harness_engineering: [] # pi extensions loaded into the harness (-e)
+ # Roster-wide allowlist; any agent may override with its own list.
+ # NOTE: --tools filters extension and custom tools too, not just builtins. An agent
+ # whose harness_engineering extension registers a tool MUST name that tool in its own
+ # tools list — otherwise the extension loads and its tool is silently filtered out.
+ tools:
+  - read # read file contents
+  - bash # execute bash commands
+  - edit # find/replace edits
+  - write # create/overwrite files
+  - grep # search file contents  (pi default: OFF)
+  - find # find files by glob     (pi default: OFF)
+  - ls # list directories       (pi default: OFF)
+ # Off-limits to every agent that does not name them in its own `writes`.
+ # `tools` alone cannot protect these: bash runs `git checkout`, and write
+ # reaches any path. An agent must not be able to edit the machinery that
+ # decides whether its own work passed. Enforced in adw_modules/permissions.py.
+ #
+ # `writes:` per agent says what it may change IN THE REPO. It never restricts
+ # the session runtime under data_dir — context_handoff/, envelopes, prompts,
+ # raw output. Every agent can always write its own report; `writes: []` means
+ # read-only with respect to the repo, not mute.
+ protected_files:
+  - adws/adw_modules/
+  - adws/adw_sssf_config/
+  - adws/adw_*.py
+ data_dir: adws/adw_data # runtime home: {data_dir}/sessions/{adw_id}/{agent_name}/
+
+observability:
+ db: adws/adw_data/sssf.db # tracer writes here directly; the UI polls it
+ poll_ms: 500 # visualizer live-poll cadence
+
+agents:
+ - name: planner
+   model: fireworks/accounts/fireworks/models/kimi-k3
+   thinking: high
+   color: "#a78bfa" # optional hex — the agent's lane color in the visualizer
+   purpose: Turn a request into a plan the builder can implement without asking questions.
+   prompt_engineering:
+    system: adws/adw_data/prompt_engineering/planner/system.md
+    user: adws/adw_data/prompt_engineering/planner/user.md
+   harness_engineering:
+    - adws/adw_data/harness_engineering/subagents.ts # registers the four subagent_* tools below
+   writes: # the plan is the only thing it may leave in the repo
+    - specs/
+   tools: # full recon + write for plan.md; no edit — the planner never touches repo files
+    - read
+    - grep
+    - find
+    - ls
+    - bash
+    - write
+    - subagent_create # extension tools MUST be named here or they are filtered out
+    - subagent_continue
+    - subagent_list
+    - subagent_remove
+
+ - name: builder
+   color: "#22d3ee"
+   purpose: Implement the plan exactly; report every changed file in the envelope.
+   prompt_engineering:
+    system: adws/adw_data/prompt_engineering/builder/system.md
+    user: adws/adw_data/prompt_engineering/builder/user.md
+   # No `writes` key: unrestricted, and the only agent that is. It still cannot
+   # touch defaults.protected_files — the builder does not get to edit its own grader.
+   tools: # the only agent that mutates the repo — everything on
+    - read
+    - grep
+    - find
+    - ls
+    - bash
+    - edit
+    - write
+
+ - name: scout
+   color: "#fbbf24"
+   purpose: Find and report where things live; change nothing.
+   prompt_engineering:
+    system: adws/adw_data/prompt_engineering/scout/system.md
+    user: adws/adw_data/prompt_engineering/scout/user.md
+   harness_engineering:
+    - adws/adw_data/harness_engineering/subagents.ts # registers the four subagent_* tools below
+   writes: [] # read-only, and now actually read-only: its findings
+    # go to context_handoff/, which is runtime, not the repo
+   tools: # search-heavy recon; write only so scout_findings.md lands without a bash heredoc
+    - read
+    - grep
+    - find
+    - ls
+    - bash
+    - write
+    - subagent_create # extension tools MUST be named here or they are filtered out
+    - subagent_continue
+    - subagent_list
+    - subagent_remove
+
+ # No tester agent: running the suite is a known command, so it is a kind="code"
+ # phase over adw_modules/quality.py. See SKILL.md hard rule 8.
+
+ - name: reviewer
+   model: openai/gpt-5.6-terra
+   thinking: high
+   color: "#fb7185"
+   purpose: Confirm that what was built is what was asked for; change nothing.
+   prompt_engineering:
+    system: adws/adw_data/prompt_engineering/reviewer/system.md
+    user: adws/adw_data/prompt_engineering/reviewer/user.md
+   writes: [] # a reviewer that cannot fix cannot quietly fix — the
+    # claim the tool list only implied, now enforced
+   tools: # full read surface; write only for review.md, no edit
+    - read
+    - grep
+    - find
+    - ls
+    - bash
+    - write
+
+ - name: documenter
+   model: openai/gpt-5.6-luna
+   color: "#e879f9"
+   purpose: Write up the change that was just made, from the diff; document only.
+   prompt_engineering:
+    system: adws/adw_data/prompt_engineering/documenter/system.md
+    user: adws/adw_data/prompt_engineering/documenter/user.md
+   writes: # documentation only — "document only" is a rule now,
+    - app_docs/ # not a line in a prompt the model may drift from.
+    - docs/ # Markdown anywhere, because docs live next to the
+    - "**/*.md" # code they describe as often as in a docs folder.
+    - "*.md"
+   tools: # reads the diff and the code; writes/edits documentation only
+    - read
+    - grep
+    - find
+    - ls
+    - bash
+    - write
+    - edit