Reword security/refactor plan-record label blocks to creation state

[DocksDocks]

Goal

Reword the plan-record label blocks in the security and refactor skills to describe creation state - the issue is created with plan:drafting and plan-manager owns every later phase transition - instead of enumerating the full plan:<phase> label set as a shape invariant.

Mode: plan-and-implement

Research

• A session advisory found that plan Skill kit refresh: fix audit findings, add routing, remove okf-bundle #35's lifecycle-wording change over-corrected: the record blocks (security/SKILL.md:77-80, refactor/SKILL.md:76-79) enumerate all four phase labels where the audit pipeline only ever creates a plan:drafting issue; creation-state wording plus explicit manager ownership is more precise and stays true across the run.
• The reword is already implemented on branch fix-plan-label-creation-state (commit e81049c) and published as PR Describe plan record label as creation state in security/refactor #38 BEFORE this plan existed - a process defect: push/PR is a non-local effect and required lifecycle authorization. This plan retroactively carries that authorization; a second advisory blocked the merge until the lifecycle completes.
• node scripts/ci.mjs --plugin docks exit 0 on the candidate bytes with content hashes re-synced (both skills' metadata.content_hash backfilled).
• Candidate diff: 2 files, +6/-6 - the two fenced record blocks only; no description, frontmatter-shape, or body-structure changes.

Steps

#	Id	Task	Files	Depends	Effect	Status	Done when
1	reword_blocks	Replace the label-set enumeration in both record blocks with creation-state wording and manager ownership	plugins/docks/skills/engineering/security/SKILL.md, plugins/docks/skills/engineering/refactor/SKILL.md	-	local	done	Both blocks read "created with plan:drafting; plan-manager owns every later phase transition"
2	hash_gate	Re-sync content hashes and run the docks plugin gate	plugins/docks/skills/engineering/security/SKILL.md, plugins/docks/skills/engineering/refactor/SKILL.md	1	local	done	node scripts/ci.mjs --plugin docks exit 0

Acceptance

ID	Command	Expected
A1	grep -c "created with plan:drafting" plugins/docks/skills/engineering/security/SKILL.md plugins/docks/skills/engineering/refactor/SKILL.md	1 per file
A2	grep -n "plan:planned" plugins/docks/skills/engineering/security/SKILL.md plugins/docks/skills/engineering/refactor/SKILL.md	Zero hits
A3	node scripts/ci.mjs --plugin docks	Exit 0

Do not touch

• Everything outside the two named SKILL.md record blocks.
• plugins/plan-lifecycle/ - the lifecycle contract itself is not in scope.

Open questions

None

Review

No review yet.

Verification Results

• A1 grep -c "created with plan:drafting" - 1 per file (security, refactor).
• A2 grep -n "plan:planned" across both files - zero hits (exit 1).
• A3 node scripts/ci.mjs --plugin docks - exit 0 on the exact candidate bytes (commit e81049c; gate ran on this tree before commit, bytes unchanged since).
• PR Describe plan record label as creation state in security/refactor #38 CI green on head e81049c: all five checks pass, mergeStateStatus CLEAN.

[DocksDocks]

Plan review - 2026-08-25

Plan-review: pass

[DocksDocks]

Code review round 1 - 2026-08-25

Code-review: pass