Update superpowers to v6.1.1

[renovate-f1sherman]

This PR contains the following updates:

Package	Update	Change
obra/superpowers	patch	v6.1.0 → v6.1.1

---

Release Notes

obra/superpowers (obra/superpowers)

v6.1.1

Compare Source

Codex

• Codex no longer re-registers the Claude SessionStart hook. v6.1.0 removed the Codex hook config and its manifest hooks pointer, meaning to stop Codex from installing a SessionStart hook — but with no hooks field, Codex fell back to auto-discovering hooks/hooks.json, the Claude Code SessionStart hook that the marketplace ships from the repo root, and re-registered it along with its install-time trust prompt. The Codex manifest now declares an explicit empty hooks object (hooks: {}), which Codex reads as "no hooks" instead of reaching the auto-discovery fallback. An absent field, [], and an empty inline list all collapse back to the fallback, so the value has to be exactly {}.
• Removed orphaned Codex session-start dead code. hooks/session-start-codex had no caller once the Codex hook config was deleted, so it and its redundant test cases are gone. The worked shell-hook example in docs/porting-to-a-new-harness.md moves from Codex — now native skill discovery with no session-start hook — to Cursor, a live shell-hook harness, and the stale hooks-codex.json pointer in docs/windows/polyglot-hooks.md is corrected. The Codex plugin category is also fixed to "Developer Tools".

Packaging

• New package-codex-plugin.sh for building the Codex portal package. A maintainer script produces a deterministic Codex "portal" archive — .zip by default, tar.gz on request — that normalizes entry timestamps, preserves executable modes, verifies every packaged skill ships its OpenAI metadata, includes the app and composer icons, and refuses to run against a dirty worktree. The packaged manifest keeps the source hooks: {} object so a portal-installed plugin avoids the same SessionStart auto-discovery, and the script can rebuild a byte-identical archive from a saved metadata source. Covered by a new test suite.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[f1sherman]

Pull Request Review

• Reviewed at: 2026-07-10T06:59:02Z
• Reviewed head SHA: ad42f507b88a23af75b92708b669598414e96b90
• Risk: low
• Merge OK: true
• Verdict: patch is correct
• Confidence: 0.92
• Priority counts: P0=0 P1=0 P2=0 P3=0
• Inline findings posted: 0
• Unplaced findings: 0

The patch only bumps the pinned obra/superpowers git tag from v6.1.0 to v6.1.1. The tag exists upstream, and the local consumers use this value only for the Ansible git checkout that links the repository's skills/ directory, so I found no introduced breakage.

No actionable findings.