feat(v-onboard): add Operations/Deployment coverage dimension to /v:onboard

[khymerao]

What

Adds an explicit Operations / Deployment coverage dimension to the /v:onboard pipeline. When a repo has CI/CD, container, or deploy files, onboarding now produces a cited docs/superpowers/architecture/operations.md instead of silently dropping that layer from the generated knowledge base.

Additive & gated — operations.md is only generated when ops files are present and the maintainer confirms it at the existing HUMAN GATE; an unattended/auto-approve run includes it with no new code path.

Why

pack already includes docker/**, .github/workflows/*, Terraform, and deploy scripts, so the raw material reached EXTRACT — but DETECT never inventoried it, EXTRACT had no claim type for it, and the arch doc set was fixed at architecture.md / business-logic.md / tech-context.md. Net effect: Docker topology, CI/CD, production domain, and runbooks were silently skipped — becoming confident partial truth downstream. This closes that blind spot.

How it works

• New deterministic detect-ops subcommand (mirrors detect-ui) inventories three categories — CI/CD (.github/workflows/*, .gitlab-ci.yml, .circleci/config.yml, Jenkinsfile, …), containers/infra (Dockerfile*, docker-compose*/compose.*, *.tf/*.tfvars, k8s heuristics), and deploy/PaaS (Procfile, fly.toml, vercel.json, deploy*.sh, …). Returns {present, ci_cd[], containers[], deploy[]}; CLI prints ops/no-ops or --json.
• EXTRACT gains a 5th claim type (operations) targeting operations.md; load-bearing rules still bite (deploy-secret path, prod/branch gate, fail-closed CI check). type is free-form to verify-citations, so no schema change.
• The HUMAN GATE (§6) presents operations.md as its own explicit per-artifact confirm; declining drops it. k8s detection is an honest filename/dir heuristic, flagged as such.

Contents

• scripts/compound-v-onboard.py — detect_ops() + _ops_category() + detect-ops CLI + selftest (walks the filesystem excluding VENDOR_DIRS, so the non-git --selftest trees detect too)
• skills/compound-v/onboarding.md — DETECT bullet, EXTRACT type, operations.md doc section, §6 gate confirm, §7 write surface, refresh note
• docs/superpowers/specs/2026-06-30-v-onboard-design.md — artifacts-table row + conditional-fourth prose
• Design spec + implementation plan under docs/superpowers/{specs,plans}/2026-07-17-*

Conventions / gates (verified locally)

• ✅ python3 scripts/compound-v-onboard.py --selftest — 69/69 checks pass (64 pre-existing + 5 new detect_ops)
• ✅ detect-ops --json verified on this repo (detects its own .github/workflows/*); no-ops on a bare tree
• ✅ No verify-citations / claims-schema change; no new runtime deps, hooks, or scripts
• ⚠️ scripts/lint-frontmatter.py not run — no pyyaml in the local env; N/A regardless (diff touches no frontmatter)