feat(aidd-vcs): ci-watch skill with compact GitHub status script

Start by reading plugins/aidd-vcs/skills/02-pull-request/, plugins/aidd-dev/skills/00-sdlc/SKILL.md, and the async review path under plugins/aidd-orchestrator/skills/00-async-dev/actions/review/. Trace the existing ship/finalize flow and inspect how .aidd/config.yml features are handled. Done means the read-only ci-watch script and skill provide tested exit-code behavior, and the flag-enabled ship path blocks success on red checks without changing the default path.

Problem

Ship / open-PR paths do not wait on CI deterministically. Free-form agent polling is verbose and inconsistent. Sessions can treat work as done while checks are still red. The async orchestrator path (#149) does not give interactive sessions a compact exit-code contract.

Not a duplicate of #149

Scope

• Skill ci-watch: resolve PR | branch | run id → run script → map exit code.
• Bundled script (GitHub-first), e.g. plugin scripts/ci-watch:
  • deps: gh, jq;
  • flags: --repo, --pr | --run | --branch, optional --workflow, --interval;
  • compact stdout (state-change lines; failed job logs only on red);
  • stable exit codes documented in script header + skill (pass / fail / cancelled / other / pass-but-not-merged if merge watch);
  • pure classifiers unit-testable without network.
• Integration contract (non-vacuous):
  • Feature flag features.ci_watch_before_ship in .aidd/config.yml (default false = non-breaking).
  • When true, ship/finalize path must run ci-watch and must not claim success on non-zero failure exit.
  • When false, skill remains manually invocable (standalone value).
• Skill does not re-implement polling in prose as the primary path.

Standalone value: Any session can wait on CI with stable exit codes without an async bot.

Acceptance criteria

• Green PR: exit 0; short summary.
• Red PR: non-zero failure; failed check names (+ failed logs only).
• Skill invokes script and maps exit codes (no primary agent poll loop).
• Read-only (no commits / force-push).
• With features.ci_watch_before_ship: true and red checks, ship path does not report success (doc + action test or fixture).
• With flag false/absent, ship behavior unchanged; skill still runnable alone.
• Issue body states non-duplicate vs #149 (this section).

Prior art in this repo

• #149 — async bot reacts to failing checks / quality gates (plugins/aidd-orchestrator/skills/00-async-dev/actions/review/)
• plugins/aidd-vcs/skills/02-pull-request/ — open PR / ship-adjacent external path
• plugins/aidd-dev/skills/00-sdlc/SKILL.md — ship step in interactive SDLC (no CI wait today)

Relations

Intended graph (same fields as GitHub parent / blocked-by / blocks). Formal GraphQL edges need maintainer write — see comment on #584.

Out of scope

• Auto-fix on red CI
• Non-GitHub forges in v1 (same exit-code contract later)
• Async bot loop (#149)