fix(test): the docs guard must ask git, not the disk

CI failed on the guard added in 0c3729b, which passed locally. Both were
right: docs/TODO.md sent readers to
`.superpowers/sdd/2026-09-02-versioned-allocation-rules/`, a tool-managed
ledger whose own .gitignore is `*`. It existed on the machine that wrote
the reference and has never been in the repository, so the guard saw a
real file locally and nothing at all in a fresh checkout.

Two fixes, because there were two faults:

- TODO.md now points at the four commit messages that actually record why
  those surfaces work as they do — de128e3, 1cb91d3, e3023d0, f94e458 —
  and says plainly that the fuller ledger was never committed. Three of
  the four brief defects it described are in those messages.
- The guard now checks a path is git-TRACKED, not merely present. That is
  the invariant it was always meant to enforce: a path only the author
  can follow is exactly the reference a reader cannot. It degrades to a
  filesystem check when git cannot answer, and `.superpowers/` joins
  docs/superpowers/specs/ as a declared exception — both are named in the
  docs precisely because they are not in the repository.

A fresh clone is now the standard the check measures against, so it means
the same thing on a laptop and in CI.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/TODO.md

@@ -91,12 +91,15 @@ Tasks 3-6 of the versioned-allocation-rules work — `setRuleFrom` /
 and the month view's "change from here" — were executed by hand rather than
 dispatched, and no second pair of eyes has been over the diff.
 
-Worth reading first: the task log in
-`.superpowers/sdd/2026-09-02-versioned-allocation-rules/` records every deviation
-from the original briefs with its reasoning. Four of them fixed real defects in
-the brief code — JSX that would not compile, a component that pre-filled the
-previous post's rule, a number field that could not be cleared, and missing
-validation that let a NaN allocation into the fold.
+Worth reading first: the four commit messages, `de128e3`, `1cb91d3`, `e3023d0`
+and `f94e458`. They record why each surface works the way it does, including
+three of the four places the original briefs were wrong — a number field that
+could not be cleared, a component that kept the previous post's rule because it
+was not keyed, and missing validation that let a NaN allocation into the fold.
+
+(The fuller task log lived in a tool-managed ledger under `.superpowers/`, which
+ignores its own contents and was never part of the repository. This file used to
+send readers there, which worked only on the machine that wrote it.)
 
 Both surfaces have since been seen working in a browser. What is missing is
 review, not verification.