enhance(spec-grill): require multi-class evidence for capability admission

[sungjunlee]

Context

spec-grill already says raw extraction signals are not accepted specs, but capability admission can still lean too heavily on a directory name, commit scope, or single script surface. The desired behavior is deeper confidence before a candidate becomes a durable capability contract.

Desired change

Strengthen capability admission with a multi-evidence rule.

A capability should normally need at least two evidence classes before it is accepted, for example:

• system-map boundary + scripts
• source surface + tests
• README/product signal + command surface
• recurring commits + docs/tests

A single strong user statement can still override this, but the report should say so explicitly.

Acceptance Criteria

• skills/spec-grill/SKILL.md admission test requires multiple evidence classes for accepted brownfield capabilities unless explicitly user-authorized.
• skills/spec-grill/references/capabilities.md explains surface signal vs code-understood evidence with examples.
• Grill reports distinguish raw signal, supporting evidence, and missing evidence clearly.
• Directory-only or commit-scope-only candidates remain interview seeds, not accepted capabilities.
• Existing tests or eval prompts are updated to cover weak-evidence candidate refusal.

[coderabbitai]

🔗 Related PRs

#155 - Align spec-system harness signals [merged]
#160 - [codex] split spec charter and grill skills [merged]
#174 - feat(backlog-triage): add spec-aware Decision Review [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[sungjunlee]

Implementation note after scope clarification: extract-signals.js should remain a shallow candidate sensor. This issue is mainly about strengthening the Markdown admission contract and report wording. Do not turn extraction output into accepted capabilities automatically; accepted capabilities still require code-understood evidence and agent judgment.