refactor-plan-gate

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). Outsider free text can enter the LLM context via the runtime diagnosis/spec-kit checkpoint: the skill detects .specify/ and then consumes existing project-authored spec artifacts (spec.md/plan.md and related .specify/ content) as part of the plan in Mode 1/3, which are not authored by the operating user.