chore: split composer-prompting skill into references/, add tsc --checkJs to CI

[freema]

Summary

Last of four PRs porting patterns from openai/codex-plugin-cc. Independent of #17/#18/#19 (branched from main).

• Skill progressive disclosure — composer-prompting now mirrors codex's gpt-5-4-prompting layout: a slim always-loaded SKILL.md (when to use, repo grounding, assembly checklist) plus on-demand references/:
  • prompt-anatomy.md — the five sections + guardrails, extended with a full worked example prompt
  • model-selection.md — escalation ladder, chunking heuristics, resume-vs-fresh
  • composer-antipatterns.md — new: six prompt shapes that reliably produce bad Composer runs, each with the fix (adapted from codex's anti-patterns reference)
• npm run typecheck in CI — tsc --checkJs --noEmit over the JSDoc annotations in scripts/lib/ (tsconfig.check.json, same approach as codex's tsconfig.app-server.json). Dev-time only: typescript + @types/node are devDependencies, nothing compiles, .mjs remains the ship artefact — the zero-runtime-deps and no-build-step rules are untouched (AGENTS.md wording clarified).
• The first typecheck run immediately paid for itself, catching two real annotation gaps (fixed here): collectReviewContext's mode inferred as string vs the declared 'working-tree'|'branch' union (git.mjs), and walkToolUses accessing properties on a value narrowed only to object (parse.mjs).

Test plan

• npm test: 89/89 green.
• npm run lint: clean.
• npm run typecheck: clean (after the two fixes; before them it reported 9 errors across the two files).

[freema]

CodeForge Review

Verdict: approve | Score: 9/10

Clean, low-risk PR: adds a dev-time tsc --checkJs typecheck step (tsconfig.check.json) wired into CI and npm scripts, fixes the two real JSDoc/type gaps it surfaced in git.mjs and parse.mjs, and splits the oversized composer-prompting SKILL.md into a spine plus three on-demand reference docs. AGENTS.md and CHANGELOG.md are updated consistently. No runtime behavior changes; tests, lint, and the new typecheck all pass locally.

---

Reviewed by CodeForge

[freema]

CodeForge Review

Verdict: approve | Score: 9/10

Clean, low-risk PR: adds a dev-time tsc --checkJs typecheck step (JS stays the ship artefact, no build step introduced), wires it into CI, fixes the two real JSDoc/type gaps it surfaced in git.mjs and parse.mjs, and splits the composer-prompting skill's SKILL.md into progressive-disclosure references. Verified locally: npm run typecheck, npm run lint, and npm test all pass (one pre-existing, unrelated flaky test in tests/jobs.test.mjs also fails identically on main, confirmed by diffing against origin/main). No behavioral/runtime code changes — the .mjs edits are type-annotation-only and preserve existing logic.

---

Reviewed by CodeForge

[freema]

[MINOR] The typecheck only includes scripts/lib/*.mjs, not the top-level scripts/*.mjs command entrypoints (e.g. delegate.mjs, status.mjs, cancel.mjs) or scripts/**/*.mjs recursively for any nested lib subfolders. If those files also carry JSDoc annotations, they get no CI type-safety coverage.

Suggestion: Consider broadening include to ["scripts/**/*.mjs"] in a follow-up once the top-level command scripts are confirmed clean, so future JSDoc drift there is also caught.

[freema]

[SUGGESTION] Introducing the obj alias only inside walkToolUses (while pickText above still accesses item.type/item.text on values narrowed similarly) is a slightly inconsistent style — future readers may wonder why one function needs the cast and the other doesn't.

Suggestion: Optional: add a short comment noting that the cast is required here because checkJs won't let TS index a bare object-narrowed value, whereas pickText's item is already inferred as any/unknown-safe from its call context.