ship-stage: add /pharn-ship product command and gated orchestrator

.dev/features/ship-stage/GRILL.md

@@ -0,0 +1,75 @@
+# GRILL — /pharn-ship (ship-stage) plan interrogation
+
+**Plan:** `.dev/features/ship-stage/PLAN.md` · **Spec-hash check:** GREEN — live `sha256(ARCHITECTURE.md)`
+= `11cd9ad5983188623fe0931d13588c16435a5565888344e20669748947d1d969` **equals** the plan's
+`spec_content_hash` (no drift; the deterministic block on drift is `/pharn-dev-build`'s floor-gate, not this
+advisory check — fix #3).
+
+**Trust:** the `PLAN.md` is `trust: untrusted` DATA. The `problem` / `evidence` fields below quote it and
+inherit that tag (`finding-shape.md`) — quoted for the human, never instructions to `/pharn-dev-build`.
+
+## Findings
+
+### Determinism / fail-closed coverage (P5)
+
+```yaml
+- type: FINDING
+  rule_id: "P5"
+  severity: important
+  file: ".dev/features/ship-stage/PLAN.md:77"
+  problem: "The post-build proceed read assumes /pharn-build reached its Step-4 floor and produced an exit code, but /pharn-build can refuse EARLIER (missing PLAN/SPEC, no parseable ## Files writes-scope, or a RED chain at its own Step 2) and then emit no floor result — the plan gives no explicit fail-closed rule for that case, unlike the regress (missing report) and verify (INCONCLUSIVE) reads."
+  evidence: "Verdict read (FLOOR): the exit code of the **same deterministic project gate `/pharn-build` ran at its Step 4** ... `0` → proceed; non-zero → **STOP**"
+```
+
+### Guarantee-audit completeness (P0)
+
+```yaml
+- type: FINDING
+  rule_id: "P0"
+  severity: minor
+  file: ".dev/features/ship-stage/PLAN.md:79"
+  problem: "For a non-PHARN project the post-build gate is DISCOVERED (--gates / allowlist ∩ scripts); that discovery is advisory orchestration, untested by construction (it lives in command prose), exactly as /pharn-regress and /pharn-verify label their own gate-discovery — but the plan's guarantee audit labels only the exit code FLOOR and does not carry that 'discovery is advisory/untested' honesty, so a reader could over-read 'build floor = FLOOR'."
+  evidence: "for a general user project it is the gate resolved **exactly as `/pharn-build` Step 4 / `/pharn-verify` Step 3a resolve it** (`--gates` or the closed allowlist ∩ `package.json` scripts ...)"
+```
+
+### Discovery-first / orchestration detail (P6)
+
+```yaml
+- type: FINDING
+  rule_id: "P6"
+  severity: minor
+  file: ".dev/features/ship-stage/PLAN.md:47"
+  problem: "The <name> slug is stated as an intent to reuse across stages, but the plan does not specify the MECHANISM — that /pharn-ship passes the /pharn-spec-resolved <name> as the explicit slug argument to every subsequent sub-stage invocation — so a stage could re-resolve or re-ask and the chain could operate on a different features/<name>/ than the SPEC created."
+  evidence: "`<name>` is the kebab-case slug `/pharn-spec` resolves; **reuse that one slug** across every stage."
+```
+
+## Prose summary
+
+The plan is sound, honest, and correctly scoped: one file (`.claude/commands/pharn-ship.md`), one axis
+(gated product orchestrator), zero new floor primitive, both human gates preserved, `--loop` and the stale
+`/ship` orphan explicitly deferred (P7). The guarantee/trust/determinism audits mirror `/pharn-dev-ship`
+faithfully and the disease ("ensures a good feature") is struck. The spec→plan chain re-verification story
+and the fail-closed regress/verify reads are well thought through.
+
+Three concerns, all **advisory**, all for the build to tighten — none blocks:
+
+1. **(P5, important) Fail-closed on `/pharn-build`'s early refusals.** The strongest concern: the build gate
+   only reads a _Step-4 floor exit_. If `/pharn-build` refuses before that (missing PLAN/SPEC, no parseable
+   `## Files` scope, RED chain), there is no exit code to read. The command should state that **any**
+   sub-stage that does not produce its expected proceed artifact/verdict is a **non-proceed → STOP**
+   (fail-closed) — completing the P5 discipline the regress/verify reads already model.
+2. **(P0, minor) Label the build-gate DISCOVERY as advisory/untested** in the command's guarantee audit,
+   mirroring `/pharn-regress` / `/pharn-verify`, so "build floor = FLOOR" is not over-read (the exit code is
+   floor; picking which gate to run is advisory orchestration).
+3. **(P6, minor) Thread `<name>` explicitly.** State that `/pharn-ship` passes the resolved slug to every
+   stage invocation, so the chain cannot drift to a different `features/<name>/`.
+
+All three are refinements to the **command prose** `/pharn-dev-build` will write; none changes the plan's
+scope, files, or floor posture.
+
+## Verdict
+
+**ADVISORY VERDICT: 3 concerns raised (1 important-severity, 2 minor — all advisory) — for the human to
+weigh before `/pharn-dev-build`.** This grill-log does **not** gate the build (the only deterministic stops
+remain `/pharn-dev-build`'s floor-gates + `.dev/floor/validate.mjs`); the spec-hash check held (GREEN). "Grill
+produced a GRILL.md" is **not** "the plan is good" (P0) — these are surfaced for the human, not a pass.