feat(aidd-pm): orchestrate a product backlog

[blafourcade]

Problem

aidd-pm produces isolated documents. Nothing connects an outcome to the work that delivers it, nothing records what is blocked by what, and nothing can tell whether the result still holds together after a change. A team using it has a folder of files, not a backlog.

Scope

• 00-backlog: an orchestrator that triages an incoming need, routes each change to the capability that owns it, gets it approved, applies it, and verifies the result. It never writes itself.
• 07-epic, 10-task, 09-defect: the artifact capabilities the backlog was missing, alongside the existing Story, Spike, and Product Brief.
• 02-user-stories: reworked to the same shape as the others.
• 08-three-amigos plus three read-only advocate agents: product, delivery, and quality refinement of an Epic or a Story, reconciled into one verdict.
• hooks/check-backlog.js: a validator for the Markdown backlog. It serves the read model the orchestrator inspects, and runs on write to catch a broken artifact immediately.
• aidd-context: a backlog memory concern, so a project records which tool owns which artifact and field.

Acceptance criteria

• An Epic, a Story, a Task, a Spike, and a Defect can be created, linked, ordered, and closed through the backlog skill
• Each field has exactly one owning artifact, and a relation is stored once
• A structurally broken artifact is reported at the write that broke it
• A graph error (missing target, cycle, duplicate order) is reported when the change set is complete, not mid-way
• The documented statuses and field ownership cannot drift from the validator without failing the suite
• A skill invoked with the wrong kind of request redirects instead of refusing
• No skill reads another skill's files

Prior art in this repo

• plugins/aidd-pm/skills/05-spike/ and 06-product-brief/ — already shipped, same router shape, reused rather than rewritten.
• plugins/aidd-pm/skills/05-spike/references/capabilities.md — finding a capability by need and naming it by role; the handoff tables copy it.
• plugins/aidd-context/hooks/ and plugins/aidd-refine/hooks/ — the precedent for a plugin shipping a Node hook.

Out of scope

• Syncing the backlog to an external tracker. The support model allows it; only the Markdown support is implemented and validated.
• Continuations in the handoff tables: today they cover what a skill refuses, not where it sends work after succeeding. Tracked in aidd_docs/tasks/2026_07/2026_07_30_backlog-hardening/.