fix(explore): require explicit confirmation before writing files - #1716

Status

LGTM. The write-confirmation contract is scope-bound, generated output is in parity, and CI is green.

What was wrong

Explore allowed OpenSpec artifacts “if the user asks,” which could let an agent mistake answers to its own design questions for consent to write. Workflow configuration such as schemas, templates, and openspec/config.yaml was also not clearly classified as implementation work.

How it was fixed

Both Explore delivery surfaces now:

• allow read-only commands and tools without confirmation;
• require a direct yes/no question before the first write-capable action;
• name the artifacts or files and proposed changes before asking;
• accept confirmation only in a separate user message;
• limit confirmation to the described scope and ask again before expanding it;
• allow creating or updating OpenSpec change artifacts only within that confirmed scope;
• keep workflow configuration and application-code changes outside Explore mode.

The committed openspec-explore skill was regenerated from the source template and parity hashes were refreshed.

Replication / proof

• Explore template and generated-skill tests: 40/40 passed.
• Build and lint pass.
• GitHub checks are green.
• Regression assertions cover read-only access, separate confirmation, named scope, scope expansion, workflow configuration, and source/generated parity.

Notes / nits

This changes prompt behavior only. It does not alter CLI write paths or grant Explore permission to implement application code.

Closes #1715