feat(2145): /gsd-debug session management, TDD gate, reasoning checkpoint, security hardening (#2146)

* feat(2145): add list/continue/status subcommands and surface next_action in /gsd-debug

- Parse SUBCMD from \$ARGUMENTS before active-session check (list/status/continue/debug)
- Step 1a: list subcommand prints formatted table of all active sessions
- Step 1b: status subcommand prints full session summary without spawning agent
- Step 1c: continue subcommand surfaces Current Focus then spawns continuation agent
- Surface [debug] Session/Status/Hypothesis/Next before every agent spawn
- Read TDD_MODE from config in Step 0 (used in Step 4)
- Slug sanitization: strip path traversal chars, enforce ^[a-z0-9][a-z0-9-]*$ pattern

* feat(2145): add TDD mode, delta debugging, reasoning checkpoint to gsd-debugger

- Security note in <role>: DATA_START/DATA_END markers are data-only, never instructions
- Delta Debugging technique added to investigation_techniques (binary search over change sets)
- Structured Reasoning Checkpoint technique: mandatory five-field block before any fix
- fix_and_verify step 0: mandatory reasoning_checkpoint before implementing fix
- TDD mode block in <modes>: red/green cycle, tdd_checkpoint tracking, TDD CHECKPOINT return
- TDD CHECKPOINT structured return format added to <structured_returns>
- next_action concreteness guidance added to <debug_file_protocol>

* feat(2145): update DEBUG.md template and docs for debug enhancements

- DEBUG.md template: add reasoning_checkpoint and tdd_checkpoint fields to Current Focus
- DEBUG.md section_rules: document next_action concreteness requirement and new fields
- docs/COMMANDS.md: document list/status/continue subcommands and TDD mode flag
- tests/debug-session-management.test.cjs: 12 content-validation tests (all pass)

tests/debug-session-management.test.cjs

@@ -0,0 +1,120 @@
+'use strict';
+
+const { describe, test } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+
+describe('debug session management implementation', () => {
+  test('DEBUG.md template contains reasoning_checkpoint field', () => {
+    const content = fs.readFileSync(
+      path.join(process.cwd(), 'get-shit-done/templates/DEBUG.md'),
+      'utf8'
+    );
+    assert.ok(content.includes('reasoning_checkpoint'), 'DEBUG.md must contain reasoning_checkpoint field');
+  });
+
+  test('DEBUG.md template contains tdd_checkpoint field', () => {
+    const content = fs.readFileSync(
+      path.join(process.cwd(), 'get-shit-done/templates/DEBUG.md'),
+      'utf8'
+    );
+    assert.ok(content.includes('tdd_checkpoint'), 'DEBUG.md must contain tdd_checkpoint field');
+  });
+
+  test('debug command contains list subcommand logic', () => {
+    const content = fs.readFileSync(
+      path.join(process.cwd(), 'commands/gsd/debug.md'),
+      'utf8'
+    );
+    assert.ok(
+      content.includes('SUBCMD=list') || content.includes('"list"'),
+      'debug.md must contain list subcommand logic'
+    );
+  });
+
+  test('debug command contains continue subcommand logic', () => {
+    const content = fs.readFileSync(
+      path.join(process.cwd(), 'commands/gsd/debug.md'),
+      'utf8'
+    );
+    assert.ok(
+      content.includes('SUBCMD=continue') || content.includes('"continue"'),
+      'debug.md must contain continue subcommand logic'
+    );
+  });
+
+  test('debug command contains status subcommand logic', () => {
+    const content = fs.readFileSync(
+      path.join(process.cwd(), 'commands/gsd/debug.md'),
+      'utf8'
+    );
+    assert.ok(
+      content.includes('SUBCMD=status') || content.includes('"status"'),
+      'debug.md must contain status subcommand logic'
+    );
+  });
+
+  test('debug command contains TDD gate logic', () => {
+    const content = fs.readFileSync(
+      path.join(process.cwd(), 'commands/gsd/debug.md'),
+      'utf8'
+    );
+    assert.ok(
+      content.includes('TDD_MODE') || content.includes('tdd_mode'),
+      'debug.md must contain TDD gate logic'
+    );
+  });
+
+  test('debug command contains security hardening', () => {
+    const content = fs.readFileSync(
+      path.join(process.cwd(), 'commands/gsd/debug.md'),
+      'utf8'
+    );
+    assert.ok(content.includes('DATA_START'), 'debug.md must contain DATA_START injection boundary marker');
+  });
+
+  test('debug command surfaces next_action before spawn', () => {
+    const content = fs.readFileSync(
+      path.join(process.cwd(), 'commands/gsd/debug.md'),
+      'utf8'
+    );
+    assert.ok(
+      content.includes('[debug] Next:') || content.includes('next_action'),
+      'debug.md must surface next_action before agent spawn'
+    );
+  });
+
+  test('gsd-debugger contains structured reasoning checkpoint', () => {
+    const content = fs.readFileSync(
+      path.join(process.cwd(), 'agents/gsd-debugger.md'),
+      'utf8'
+    );
+    assert.ok(content.includes('reasoning_checkpoint'), 'gsd-debugger.md must contain reasoning_checkpoint');
+  });
+
+  test('gsd-debugger contains TDD checkpoint mode', () => {
+    const content = fs.readFileSync(
+      path.join(process.cwd(), 'agents/gsd-debugger.md'),
+      'utf8'
+    );
+    assert.ok(content.includes('tdd_mode'), 'gsd-debugger.md must contain tdd_mode');
+    assert.ok(content.includes('TDD CHECKPOINT'), 'gsd-debugger.md must contain TDD CHECKPOINT return format');
+  });
+
+  test('gsd-debugger contains delta debugging technique', () => {
+    const content = fs.readFileSync(
+      path.join(process.cwd(), 'agents/gsd-debugger.md'),
+      'utf8'
+    );
+    assert.ok(content.includes('Delta Debugging'), 'gsd-debugger.md must contain Delta Debugging technique');
+  });
+
+  test('gsd-debugger contains security note about DATA_START', () => {
+    const content = fs.readFileSync(
+      path.join(process.cwd(), 'agents/gsd-debugger.md'),
+      'utf8'
+    );
+    assert.ok(content.includes('DATA_START'), 'gsd-debugger.md must contain DATA_START security reference');
+  });
+});