feat(ux-optimization): runtime-audit mode (ADR 0015)

[chrispezza]

Summary

• The QuillCode production run exposed the reverse pass's missing third verification mode: products that are locally runnable but not deployed (CLI/native/desktop) skipped live-site auditing correctly and were left "strategy-rich, experience-blind." A manual build-and-run pass proved the mode's unique finding classes — failure paths graded against the product's own diagnostics ("knowledge present, unwired"), fixture-vs-demo distinctions that corrected a static recommendation, placeholder-credential misdiagnosis, and silent state side effects.
• ADR 0015 (Accepted, owner-directed) encodes it as 11_runtime_audit.md (Tier 2, gated on local runnability + build toolchain), with safety boundaries as part of the decision: placeholder credentials only, no permission workarounds, complete state cleanup. 09_optimization_spec now consumes runtime_audit (and applies [corrects] revisions). Also adds docs/DEFERRED.md (D1-D8 deferred-work log).

Type of change

• Bug fix
• New feature (non-breaking)
• Prompt content change
• Breaking change
• Schema / compilation / validation change
• Documentation only
• Build / CI / tooling

Affected components

• Plugin (plugin/) — commands, skills, subagent
• Documentation (docs/, README.md, CLAUDE.md)
• Prompts (prompts/dev/)
• Compilation pipeline / Validation pipeline / Handoff generator / MCP server / CI

Test plan

• checks/run_checks.py green — zero findings on new files; all 10 passing checks unchanged
• Method field-tested before encoding: every rule in the prompt is transcribed from the actual QuillCode build-and-run pass (raw-NSError finding, mock-fixture correction, "Balance unavailable" misdiagnosis, QUILLCODE_HOME asymmetry, permission-boundary documentation)
• CI green on this PR

ADR impact

• No ADR needed
• New ADR added: docs/adrs/0015-runtime-audit-mode.md (Accepted — completes the verification-mode triad begun in ADR 0014)
• Existing ADR updated: —

Notes for reviewers

• The three modes now: code-only (always) → live-site (ADR 0014 gate) → runtime (this gate); a product may qualify for both gated modes.
• Build failure degrades to code-only without blocking — stated in both the ADR and the SKILL.md execution text.
• docs/DEFERRED.md is new: framework-side deferred items with trigger conditions (includes the pre-existing warn-only check findings as D8).

🤖 Generated with Claude Code