feat(design): ask once before downloading impeccable's engine

When the probe prints DESIGN_DETECTOR_INSTALL_OFFER the design skills ask the
user one AskUserQuestion, in interactive sessions only (spawned or headless
runs never install and never ask; Conductor gets the prose brief), before
any other step: install the engine now, not now, never ask again
(design_detector_install_prompted), or turn the detector off. A yes runs the
receipted, checksum-pinned install and the skill continues with a READY probe.
The brief says what impeccable is, what the one file is, where it goes, how
it is verified and logged, and that no skill or hook comes with it; users who
want the /impeccable skill run npx impeccable install themselves.

design-review carries the brief inline (it is not carved). design-html keeps
its skeleton small: the probe block points at a new read-on-demand section,
sections/detector-install-offer.md, registered in its manifest and carve
guard; its skeleton ceiling is re-measured (55,262) and its eager ceiling
set to the measured 13,767. The review and ship passes state that they never
offer an install. NOTICE.md, README, docs/skills.md, the interop design doc,
and the CHANGELOG describe the new posture: gstack still never runs
impeccable's installer or launcher; the one download is consented, pinned,
and receipted. Ship goldens refreshed for the review-pass wording.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

ship/sections/review-army.md

@@ -86,7 +86,7 @@ source <(~/.claude/skills/gstack/bin/gstack-diff-scope <base> 2>/dev/null)
 
 **If `SCOPE_FRONTEND=true`:**
 
-0. **Mechanical pass first.** Probe for a design detector the user installed (gstack never installs one):
+0. **Mechanical pass first.** Probe for a design detector the user installed (this pass never offers to install one; the design skills ask, once):
 
 ```bash
 bun --no-env-file run $HOME/.claude/skills/gstack/bin/gstack-design-detect.ts probe --host claude